diff --git a/samples/snippets/access_secret_version.py b/samples/snippets/access_secret_version.py index a8e2837..0939efe 100644 --- a/samples/snippets/access_secret_version.py +++ b/samples/snippets/access_secret_version.py @@ -18,6 +18,8 @@ import argparse +import google_crc32c + # [START secretmanager_access_secret_version] def access_secret_version(project_id, secret_id, version_id): @@ -38,6 +40,13 @@ def access_secret_version(project_id, secret_id, version_id): # Access the secret version. response = client.access_secret_version(request={"name": name}) + # Verify payload checksum. + crc32c = google_crc32c.Checksum() + crc32c.update(response.payload.data) + if response.payload.data_crc32c != int(crc32c.hexdigest(), 16): + print("Data corruption detected.") + return response + # Print the secret payload. # # WARNING: Do not print the secret in a production environment - this diff --git a/samples/snippets/add_secret_version.py b/samples/snippets/add_secret_version.py index 442b12e..4481259 100644 --- a/samples/snippets/add_secret_version.py +++ b/samples/snippets/add_secret_version.py @@ -19,6 +19,8 @@ import argparse +import google_crc32c + # [START secretmanager_add_secret_version] def add_secret_version(project_id, secret_id, payload): @@ -39,9 +41,17 @@ def add_secret_version(project_id, secret_id, payload): # pass in bytes instead of a str for the payload argument. payload = payload.encode("UTF-8") + # Calculate payload checksum. Passing a checksum in add-version request + # is optional. + crc32c = google_crc32c.Checksum() + crc32c.update(payload) + # Add the secret version. response = client.add_secret_version( - request={"parent": parent, "payload": {"data": payload}} + request={ + "parent": parent, + "payload": {"data": payload, "data_crc32c": int(crc32c.hexdigest(), 16)}, + } ) # Print the new secret version name. diff --git a/samples/snippets/requirements.txt b/samples/snippets/requirements.txt index 5777fd4..a39470b 100644 --- a/samples/snippets/requirements.txt +++ b/samples/snippets/requirements.txt @@ -1 +1,2 @@ -google-cloud-secret-manager==2.9.1 \ No newline at end of file +google-cloud-secret-manager==2.9.1 +google-crc32c==1.3.0 \ No newline at end of file