Function encrypt_env_vars_sync

sdk/python/src/dstack_sdk/encrypt_env_vars.py:77–104

Encrypt environment variables synchronously using X25519 and AES-GCM.

(envs: List[EnvVar], public_key_hex: str)

def encrypt_env_vars_sync(envs: List[EnvVar], public_key_hex: str) -> str:
    """Encrypt environment variables synchronously using X25519 and AES-GCM."""
    # Prepare environment data as JSON
    env_dict = {"env": [{"key": env.key, "value": env.value} for env in envs]}
    env_json = json.dumps(env_dict).encode("utf-8")

    # Generate private key and derive public key
    private_key = X25519PrivateKey.generate()
    public_key = private_key.public_key()

    # Get public key bytes (32 bytes for X25519)
    public_key_bytes = public_key.public_bytes(
        encoding=serialization.Encoding.Raw, format=serialization.PublicFormat.Raw
    )

    # Generate shared secret
    remote_public_key = X25519PublicKey.from_public_bytes(hex_to_bytes(public_key_hex))
    shared_secret = private_key.exchange(remote_public_key)

    # Encrypt the data using AES-GCM
    aesgcm = AESGCM(shared_secret)
    iv = secrets.token_bytes(12)  # 12 bytes IV for GCM
    encrypted_data = aesgcm.encrypt(iv, env_json, None)

    # Combine all components: public_key + iv + encrypted_data
    result = public_key_bytes + iv + encrypted_data

    return bytes_to_hex(result)