PK���ȼRY��������€��� �v3.phpUT
�øŽg‰gñ“gux�
õ
��õ
��½T]kÛ0}߯pEhìâÙM7X‰çv%”v0֐µ{)Aå:6S$!ÉMJèߕ?R÷!>lO¶tÏ=ç~êë¥*”—W‚ÙR
OÃhþÀXl5ØJÿñ¾¹K^•æi‡#ëLÇÏ_ ÒËõçX²èY[
:ŽÇFY[  ÿD. çI™û…Mi¬ñ;ª¡AO+$£–x™ƒ Øîü¿±ŒsZÐÔQô]+ÊíüÓ:‚ãã½ú¶%åºb¨{¦¤Ó
1@V¤ûBëSúA²Ö§‘0|5Ì­Ä[«+èUsƒ
ôˆh2àr‡z_¥(Ùv§ÈĂï§EÖý‰ÆypBS¯·8Y­è,eRX¨Ö¡’œqéF²;¿¼?Ø?Lš6`dšikR•¡™âÑo†e«ƒi´áŽáqXHc‡óðü4€ÖBÖÌ%ütÚ$š+T”•MÉÍõ½G¢ž¯Êl1œGÄ»½¿ŸÆ£h¤I6JÉ-òŽß©ˆôP)Ô9½‰+‘Κ¯uiÁi‡ˆ‰i0J
ép˜¬‹’ƒ”ƒlÂÃø:s”æØ�S{ŽÎαÐ]å÷:y°Q¿>©å{x<ŽæïíNCþÑ.Mf?¨«2ý}=ûõýî'=£§ÿu•Ü(—¾IIa­"éþ@¶�¿ä
9?^-qìÇÞôvŠeÈc ðlacã®xèÄ'®âd¶çˆSEæódP/ÍÆv{Ô)Ó
?>…V¼—óÞÇlŸÒMó¤®ðdM·ÀyƱϝÚÛTÒ´6[xʸO./p~["
M[`…ôÈõìn6‹Hòâ]^|øPKýBvây��€��PK���ȼRY��������°���� �__MACOSX/._v3.phpUT
�øŽg‰gþ“gux�
õ
��õ
��c`cg`b`ðMLVðVˆP€'
qƒøˆŽ!!AP&HÇ
%PDF-1.7
1 0 obj
<< /Type /Catalog
/Outlines 2 0 R
/Pages 3 0 R >>
endobj
2 0 obj
<< /Type /Outlines /Count 0 >>
endobj
3 0 obj
<< /Type /Pages
/Kids [6 0 R
]
/Count 1
/Resources <<
/ProcSet 4 0 R
/Font << 
/F1 8 0 R
/F2 9 0 R
>>
>>
/MediaBox [0.000 0.000 595.280 841.890]
 >>
endobj
4 0 obj
[/PDF /Text ]
endobj
5 0 obj
<<
/Producer (���d�o�m�p�d�f� �2�.�0�.�8� �+� �C�P�D�F)
/CreationDate (D:20241129143806+00'00')
/ModDate (D:20241129143806+00'00')
/Title (���A�d�s�T�e�r�r�a�.�c�o�m� �i�n�v�o�i�c�e)
>>
endobj
6 0 obj
<< /Type /Page
/MediaBox [0.000 0.000 595.280 841.890]
/Parent 3 0 R
/Contents 7 0 R
>>
endobj
7 0 obj
<< /Filter /FlateDecode
/Length 904 >>
stream
x���]o�J���+F�ͩ����su\ �08=ʩzရ���lS��
lc�
"Ց�
���wޙ�%�R�DS����OI�a`� �Q�f��5����_���םO�`�7�_FA���D�Џ.j�a=�j����>��n���R+�P��l�rH�{0��w��0��=W�2D
����G���I�>�_B3ed�H�yJ�G>/��ywy�fk��%�$�2.��d_�h����&)b0��"[\B��*_.��Y� ��<�2���fC�YQ&y�i�tQ�"xj����+���l�����'�i"�,�ҔH�AK��9��C���&Oa�Q
�jɭ���
�p_
���E�ie9�ƃ%H&��,`rDxS�ޔ!�(�X!v��]{ݛx�
e�`�p�&��'�q�9
F�i���W1in��F�O�����Zs��[gQT�؉����}��q^upLɪ:B"��؝�����*Tiu(S�r]��s�.��s9n�N!K!L�M�?�*[��N�8��c��ۯ�b������YZ���SR3�n�����lPN��P�;��^�]�!'�z-���ӊ���/��껣��4�l(M�E�QL��X��~���G��M|�����*��~�;/=N4�-|y�`�i�\�e�T�<���L��G}�"В�J^���q��"X�?(V�ߣXۆ{��H[����P���c���kc�Z�9v�����?�a��R�h|��^�k�D4W���?Iӊ�]<��4�)$wdat���~���������
��|�L��x�p|N�*��E��/4�Qpi�x.>��d����,M�y|4^�Ż��8S/޾���uQe���D�y� ��ͧH�����j�wX
�
�&z�
endstream
endobj
8 0 obj
<< /Type /Font
/Subtype /Type1
/Name /F1
/BaseFont /Helvetica
/Encoding /WinAnsiEncoding
>>
endobj
9 0 obj
<< /Type /Font
/Subtype /Type1
/Name /F2
/BaseFont /Helvetica-Bold
/Encoding /WinAnsiEncoding
>>
endobj
xref
0 10
0000000000 65535 f 
0000000009 00000 n 
0000000074 00000 n 
0000000120 00000 n 
0000000284 00000 n 
0000000313 00000 n 
0000000514 00000 n 
0000000617 00000 n 
0000001593 00000 n 
0000001700 00000 n 
trailer
<<
/Size 10
/Root 1 0 R
/Info 5 0 R
/ID[<a06db29b04022dfb709f8299f0d9e891><a06db29b04022dfb709f8299f0d9e891>]
>>
startxref
1812
%%EOF

<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php:1) in <b>/home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php</b> on line <b>128</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php:1) in <b>/home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php</b> on line <b>129</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php:1) in <b>/home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php</b> on line <b>130</b><br />
<br />
<b>Warning</b>:  Cannot modify header information - headers already sent by (output started at /home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php:1) in <b>/home/u866776246/domains/wisatalogung.com/public_html/uploads/produk/1775157541_x.php</b> on line <b>131</b><br />
# -*- coding: utf-8 -*-
# Copyright 2018 Google Inc. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""Integration tests for kms command."""

from __future__ import absolute_import
from __future__ import print_function
from __future__ import division
from __future__ import unicode_literals

import os
from random import randint
from unittest import mock

from gslib.cloud_api import AccessDeniedException
from gslib.project_id import PopulateProjectId
import gslib.tests.testcase as testcase
from gslib.tests.testcase.integration_testcase import SkipForJSON
from gslib.tests.testcase.integration_testcase import SkipForS3
from gslib.tests.testcase.integration_testcase import SkipForXML
from gslib.tests.util import ObjectToURI as suri
from gslib.tests.util import SetBotoConfigForTest
from gslib.tests.util import SetEnvironmentForTest
from gslib.utils.retry_util import Retry
from gslib.utils import shim_util

_DUMMY_KEYNAME = ('projects/my-project/locations/us-central1/'
                  'keyRings/my-keyring/cryptoKeys/my-key')


@SkipForS3('gsutil does not support KMS operations for S3 buckets.')
@SkipForXML('gsutil does not support KMS operations for S3 buckets.')
class TestKmsSuccessCases(testcase.GsUtilIntegrationTestCase):
  """Integration tests for the kms command."""

  def setUp(self):
    super(TestKmsSuccessCases, self).setUp()
    # Make sure our keyRing exists (only needs to be done once, but subsequent
    # attempts will receive a 409 and be treated as a success). Save the fully
    # qualified name for use with creating keys later.
    self.keyring_fqn = self.kms_api.CreateKeyRing(
        PopulateProjectId(None),
        testcase.KmsTestingResources.KEYRING_NAME,
        location=testcase.KmsTestingResources.KEYRING_LOCATION)

  @Retry(AssertionError, tries=3, timeout_secs=1)
  def DoTestAuthorize(self, specified_project=None):
    # Randomly pick 1 of 1000 key names.
    key_name = testcase.KmsTestingResources.MUTABLE_KEY_NAME_TEMPLATE % (
        randint(0, 9), randint(0, 9), randint(0, 9))
    # Make sure the key with that name has been created.
    key_fqn = self.kms_api.CreateCryptoKey(self.keyring_fqn, key_name)
    # They key may have already been created and used in a previous test
    # invocation; make sure it doesn't contain the IAM policy binding that
    # allows our project to encrypt/decrypt with it.
    key_policy = self.kms_api.GetKeyIamPolicy(key_fqn)
    while key_policy.bindings:
      key_policy.bindings.pop()
    self.kms_api.SetKeyIamPolicy(key_fqn, key_policy)
    # Set up the authorize command tokens.
    authorize_cmd = ['kms', 'authorize', '-k', key_fqn]
    if specified_project:
      authorize_cmd.extend(['-p', specified_project])

    stdout1 = self.RunGsUtil(authorize_cmd, return_stdout=True)
    stdout2 = self.RunGsUtil(authorize_cmd, return_stdout=True)

    self.assertIn(
        'Authorized project %s to encrypt and decrypt with key:\n%s' %
        (PopulateProjectId(None), key_fqn), stdout1)
    self.assertIn(
        ('Project %s was already authorized to encrypt and decrypt with '
         'key:\n%s.' % (PopulateProjectId(None), key_fqn)), stdout2)

  def DoTestServiceaccount(self, specified_project=None):
    serviceaccount_cmd = ['kms', 'serviceaccount']
    if specified_project:
      serviceaccount_cmd.extend(['-p', specified_project])

    stdout = self.RunGsUtil(serviceaccount_cmd, return_stdout=True)

    self.assertRegex(stdout,
                     r'[^@]+@gs-project-accounts\.iam\.gserviceaccount\.com')

  def testKmsAuthorizeWithoutProjectOption(self):
    self.DoTestAuthorize()

  def testKmsAuthorizeWithProjectOption(self):
    self.DoTestAuthorize(specified_project=PopulateProjectId(None))

  def testKmsServiceaccountWithoutProjectOption(self):
    self.DoTestServiceaccount()

  def testKmsServiceaccountWithProjectOption(self):
    self.DoTestServiceaccount(specified_project=PopulateProjectId(None))

  def testKmsEncryptionFlow(self):
    # Since we have to create a bucket and set a default KMS key to test most
    # of these behaviors, we just test them all in one flow to reduce the number
    # of API calls.

    bucket_uri = self.CreateBucket()
    # Make sure our key exists.
    key_fqn = self.kms_api.CreateCryptoKey(
        self.keyring_fqn, testcase.KmsTestingResources.CONSTANT_KEY_NAME)
    encryption_get_cmd = ['kms', 'encryption', suri(bucket_uri)]

    # Test output for bucket with no default KMS key set.
    stdout = self.RunGsUtil(encryption_get_cmd, return_stdout=True)
    self.assertIn('Bucket %s has no default encryption key' % suri(bucket_uri),
                  stdout)

    # Test that setting a bucket's default KMS key works and shows up correctly
    # via a follow-up call to display it.
    stdout = self.RunGsUtil(
        ['kms', 'encryption', '-k', key_fqn,
         suri(bucket_uri)],
        return_stdout=True)
    self.assertIn('Setting default KMS key for bucket %s...' % suri(bucket_uri),
                  stdout)

    stdout = self.RunGsUtil(encryption_get_cmd, return_stdout=True)
    self.assertIn(
        'Default encryption key for %s:\n%s' % (suri(bucket_uri), key_fqn),
        stdout)

    # Finally, remove the bucket's default KMS key and make sure a follow-up
    # call to display it shows that no default key is set.
    stdout = self.RunGsUtil(
        ['kms', 'encryption', '-d', suri(bucket_uri)], return_stdout=True)
    self.assertIn(
        'Clearing default encryption key for %s...' % suri(bucket_uri), stdout)

    stdout = self.RunGsUtil(encryption_get_cmd, return_stdout=True)
    self.assertIn('Bucket %s has no default encryption key' % suri(bucket_uri),
                  stdout)


@SkipForS3('gsutil does not support KMS operations for S3 buckets.')
@SkipForJSON('These tests only check for failures when the XML API is forced.')
class TestKmsSubcommandsFailWhenXmlForced(testcase.GsUtilIntegrationTestCase):
  """Tests that kms subcommands fail early when forced to use the XML API."""

  boto_config_hmac_auth_only = [
      # Overwrite other credential types.
      ('Credentials', 'gs_oauth2_refresh_token', None),
      ('Credentials', 'gs_service_client_id', None),
      ('Credentials', 'gs_service_key_file', None),
      ('Credentials', 'gs_service_key_file_password', None),
      # Add hmac credentials.
      ('Credentials', 'gs_access_key_id', 'dummykey'),
      ('Credentials', 'gs_secret_access_key', 'dummysecret'),
  ]
  _DUMMY_KEYNAME = ('projects/my-project/locations/us-central1/'
                    'keyRings/my-keyring/cryptoKeys/my-key')

  def DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig(self, subcommand):
    with SetBotoConfigForTest(self.boto_config_hmac_auth_only):
      stderr = self.RunGsUtil(subcommand, expected_status=1, return_stderr=True)
      self.assertIn('The "kms" command can only be used with', stderr)

  def testEncryptionFailsWhenXmlForcedFromHmacInBotoConfig(self):
    self.DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig(
        ['kms', 'encryption', 'gs://dummybucket'])

  def testEncryptionDashKFailsWhenXmlForcedFromHmacInBotoConfig(self):
    self.DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig(
        ['kms', 'encryption', '-k', _DUMMY_KEYNAME, 'gs://dummybucket'])

  def testEncryptionDashDFailsWhenXmlForcedFromHmacInBotoConfig(self):
    self.DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig(
        ['kms', 'encryption', '-d', 'gs://dummybucket'])

  def testServiceaccountFailsWhenXmlForcedFromHmacInBotoConfig(self):
    self.DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig(
        ['kms', 'serviceaccount', 'gs://dummybucket'])

  def testAuthorizeFailsWhenXmlForcedFromHmacInBotoConfig(self):
    self.DoTestSubcommandFailsWhenXmlForcedFromHmacInBotoConfig(
        ['kms', 'authorize', '-k', _DUMMY_KEYNAME, 'gs://dummybucket'])


class TestKmsUnitTests(testcase.GsUtilUnitTestCase):
  """Unit tests for gsutil kms."""

  @mock.patch(
      'gslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccount')
  @mock.patch('gslib.cloud_api_delegator.CloudApiDelegator.PatchBucket')
  @mock.patch('gslib.kms_api.KmsApi.GetKeyIamPolicy')
  @mock.patch('gslib.kms_api.KmsApi.SetKeyIamPolicy')
  def testEncryptionSetKeySucceedsWhenUpdateKeyPolicySucceeds(
      self, mock_set_key_iam_policy, mock_get_key_iam_policy, mock_patch_bucket,
      mock_get_project_service_account):
    bucket_uri = self.CreateBucket()
    mock_get_key_iam_policy.return_value.bindings = []
    mock_get_project_service_account.return_value.email_address = 'dummy@google.com'

    stdout = self.RunCommand(
        'kms', ['encryption', '-k', _DUMMY_KEYNAME,
                suri(bucket_uri)],
        return_stdout=True)
    self.assertIn('Setting default KMS key for bucket', stdout)
    self.assertTrue(mock_patch_bucket.called)

  @mock.patch(
      'gslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccount')
  @mock.patch('gslib.cloud_api_delegator.CloudApiDelegator.PatchBucket')
  @mock.patch('gslib.kms_api.KmsApi.GetKeyIamPolicy')
  @mock.patch('gslib.kms_api.KmsApi.SetKeyIamPolicy')
  def testEncryptionSetKeySucceedsWhenUpdateKeyPolicyFailsWithWarningFlag(
      self, mock_set_key_iam_policy, mock_get_key_iam_policy, mock_patch_bucket,
      mock_get_project_service_account):
    bucket_uri = self.CreateBucket()
    mock_get_key_iam_policy.side_effect = AccessDeniedException(
        'Permission denied')
    mock_get_project_service_account.return_value.email_address = 'dummy@google.com'

    stdout = self.RunCommand(
        'kms', ['encryption', '-k', _DUMMY_KEYNAME, '-w',
                suri(bucket_uri)],
        return_stdout=True)
    self.assertIn('Setting default KMS key for bucket', stdout)
    self.assertTrue(mock_patch_bucket.called)

  @mock.patch(
      'gslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccount')
  @mock.patch('gslib.cloud_api_delegator.CloudApiDelegator.PatchBucket')
  @mock.patch('gslib.kms_api.KmsApi.GetKeyIamPolicy')
  @mock.patch('gslib.kms_api.KmsApi.SetKeyIamPolicy')
  def testEncryptionSetKeyFailsWhenUpdateKeyPolicyFailsWithoutWarningFlag(
      self, mock_set_key_iam_policy, mock_get_key_iam_policy, mock_patch_bucket,
      mock_get_project_service_account):
    bucket_uri = self.CreateBucket()
    mock_get_key_iam_policy.side_effect = AccessDeniedException(
        'Permission denied')
    mock_get_project_service_account.return_value.email_address = 'dummy@google.com'

    try:
      stdout = self.RunCommand(
          'kms', ['encryption', '-k', _DUMMY_KEYNAME,
                  suri(bucket_uri)],
          return_stdout=True)
      self.fail('Did not get expected AccessDeniedException')
    except AccessDeniedException as e:
      self.assertIn('Permission denied', e.reason)


class TestKmsUnitTestsWithShim(testcase.ShimUnitTestBase):
  """Unit tests for gsutil kms using shim."""

  @mock.patch(
      'gslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccount')
  @mock.patch('gslib.kms_api.KmsApi.GetKeyIamPolicy')
  @mock.patch('gslib.kms_api.KmsApi.SetKeyIamPolicy')
  def test_shim_translates_authorize_flags(self, mock_get_key_iam_policy,
                                           mock_set_key_iam_policy,
                                           mock_get_project_service_account):
    del mock_set_key_iam_policy
    mock_get_project_service_account.return_value.email_address = 'dummy@google.com'
    mock_get_key_iam_policy.return_value.bindings = []

    with SetBotoConfigForTest([('GSUtil', 'use_gcloud_storage', 'True'),
                               ('GSUtil', 'hidden_shim_mode', 'dry_run')]):
      with SetEnvironmentForTest({
          'CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTIL': 'True',
          'CLOUDSDK_ROOT_DIR': 'fake_dir',
      }):
        mock_log_handler = self.RunCommand('kms', [
            'authorize',
            '-p',
            'foo',
            '-k',
            _DUMMY_KEYNAME,
        ],
                                           return_log_handler=True)
        info_lines = '\n'.join(mock_log_handler.messages['info'])
        self.assertIn(
            'Gcloud Storage Command: {} storage service-agent'
            ' --project foo --authorize-cmek {}'.format(
                shim_util._get_gcloud_binary_path('fake_dir'), _DUMMY_KEYNAME),
            info_lines)

  def test_shim_translates_clear_encryption_key(self):
    bucket_uri = self.CreateBucket()

    with SetBotoConfigForTest([('GSUtil', 'use_gcloud_storage', 'True'),
                               ('GSUtil', 'hidden_shim_mode', 'dry_run')]):
      with SetEnvironmentForTest({
          'CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTIL': 'True',
          'CLOUDSDK_ROOT_DIR': 'fake_dir',
      }):
        mock_log_handler = self.RunCommand(
            'kms', ['encryption', '-d', suri(bucket_uri)],
            return_log_handler=True)
        info_lines = '\n'.join(mock_log_handler.messages['info'])
        self.assertIn(
            'Gcloud Storage Command: {} storage buckets update'
            ' --clear-default-encryption-key {}'.format(
                shim_util._get_gcloud_binary_path('fake_dir'),
                suri(bucket_uri)), info_lines)

  @mock.patch(
      'gslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccount')
  @mock.patch('gslib.kms_api.KmsApi.GetKeyIamPolicy')
  @mock.patch('gslib.kms_api.KmsApi.SetKeyIamPolicy')
  def test_shim_translates_update_encryption_key(
      self, mock_get_key_iam_policy, mock_set_key_iam_policy,
      mock_get_project_service_account):
    bucket_uri = self.CreateBucket()
    del mock_set_key_iam_policy
    mock_get_project_service_account.return_value.email_address = 'dummy@google.com'
    mock_get_key_iam_policy.return_value.bindings = []

    with SetBotoConfigForTest([('GSUtil', 'use_gcloud_storage', 'True'),
                               ('GSUtil', 'hidden_shim_mode', 'dry_run')]):
      with SetEnvironmentForTest({
          'CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTIL': 'True',
          'CLOUDSDK_ROOT_DIR': 'fake_dir',
      }):
        mock_log_handler = self.RunCommand(
            'kms', ['encryption', '-w', '-k', _DUMMY_KEYNAME,
                    suri(bucket_uri)],
            return_log_handler=True)
        info_lines = '\n'.join(mock_log_handler.messages['info'])
        self.assertIn(
            'Gcloud Storage Command: {} storage buckets update'
            '  --default-encryption-key {} {}'.format(
                shim_util._get_gcloud_binary_path('fake_dir'), _DUMMY_KEYNAME,
                suri(bucket_uri)), info_lines)

  def test_shim_translates_displays_encryption_key(self):
    bucket_uri = self.CreateBucket()

    with SetBotoConfigForTest([('GSUtil', 'use_gcloud_storage', 'True'),
                               ('GSUtil', 'hidden_shim_mode', 'dry_run')]):
      with SetEnvironmentForTest({
          'CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTIL': 'True',
          'CLOUDSDK_ROOT_DIR': 'fake_dir',
      }):
        mock_log_handler = self.RunCommand(
            'kms', ['encryption', suri(bucket_uri)], return_log_handler=True)
        info_lines = '\n'.join(mock_log_handler.messages['info'])
        self.assertIn(
            'Gcloud Storage Command: {} storage buckets describe '
            '--format=value[separator=\": \"](name, encryption'
            '.defaultKmsKeyName.yesno(no="No default encryption key."))'
            ' --raw {}'.format(shim_util._get_gcloud_binary_path('fake_dir'),
                               suri(bucket_uri)), info_lines)

  @mock.patch(
      'gslib.cloud_api_delegator.CloudApiDelegator.GetProjectServiceAccount')
  def test_shim_translates_serviceaccount_command(
      self, mock_get_project_service_account):
    mock_get_project_service_account.return_value.email_address = 'dummy@google.com'

    with SetBotoConfigForTest([('GSUtil', 'use_gcloud_storage', 'True'),
                               ('GSUtil', 'hidden_shim_mode', 'dry_run')]):
      with SetEnvironmentForTest({
          'CLOUDSDK_CORE_PASS_CREDENTIALS_TO_GSUTIL': 'True',
          'CLOUDSDK_ROOT_DIR': 'fake_dir',
      }):
        mock_log_handler = self.RunCommand('kms',
                                           ['serviceaccount', '-p', 'foo'],
                                           return_log_handler=True)
        info_lines = '\n'.join(mock_log_handler.messages['info'])
        self.assertIn(
            'Gcloud Storage Command: {} storage service-agent'
            ' --project foo'.format(
                shim_util._get_gcloud_binary_path('fake_dir')), info_lines)