fix deps

Author: damccorm

buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy

@@ -753,6 +753,7 @@ class BeamModulePlugin implements Plugin<Project> {
         google_cloud_dataflow_java_proto_library_all: "com.google.cloud.dataflow:google-cloud-dataflow-java-proto-library-all:0.5.160304",
         google_cloud_datastore_v1_proto_client      : "com.google.cloud.datastore:datastore-v1-proto-client:2.32.3",   // [bomupgrader] sets version
         google_cloud_firestore                      : "com.google.cloud:google-cloud-firestore", // google_cloud_platform_libraries_bom sets version
+        google_cloud_kms                            : "com.google.cloud:google-cloud-kms", // google_cloud_platform_libraries_bom sets version
         google_cloud_pubsub                         : "com.google.cloud:google-cloud-pubsub", // google_cloud_platform_libraries_bom sets version
         google_cloud_pubsublite                     : "com.google.cloud:google-cloud-pubsublite",  // google_cloud_platform_libraries_bom sets version
         // [bomupgrader] the BOM version is set by scripts/tools/bomupgrader.py. If update manually, also update
@@ -763,6 +764,7 @@ class BeamModulePlugin implements Plugin<Project> {
         google_cloud_spanner_bom                    : "com.google.cloud:google-cloud-spanner-bom:$google_cloud_spanner_version",
         google_cloud_spanner                        : "com.google.cloud:google-cloud-spanner", // google_cloud_platform_libraries_bom sets version
         google_cloud_spanner_test                   : "com.google.cloud:google-cloud-spanner:$google_cloud_spanner_version:tests",
+        google_cloud_tink                           : "com.google.crypto.tink:tink:1.19.0",
         google_cloud_vertexai                       : "com.google.cloud:google-cloud-vertexai", // google_cloud_platform_libraries_bom sets version
         google_code_gson                            : "com.google.code.gson:gson:$google_code_gson_version",
         // google-http-client's version is explicitly declared for sdks/java/maven-archetypes/examples

sdks/java/core/build.gradle

@@ -100,6 +100,8 @@ dependencies {
   shadow library.java.snappy_java
   shadow library.java.joda_time
   implementation enforcedPlatform(library.java.google_cloud_platform_libraries_bom)
+  implementation library.java.google_cloud_kms
+  implementation library.java.google_cloud_tink
   implementation library.java.google_cloud_secret_manager
   implementation library.java.proto_google_cloud_secret_manager_v1
   implementation library.java.protobuf_java

sdks/java/core/src/main/java/org/apache/beam/sdk/util/GcpHsmGeneratedSecret.java

@@ -25,9 +25,9 @@
 import com.google.cloud.secretmanager.v1.AccessSecretVersionResponse;
 import com.google.cloud.secretmanager.v1.ProjectName;
 import com.google.cloud.secretmanager.v1.Replication;
-import com.google.cloud.secretmanager.v1.SecretPayload;
 import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
 import com.google.cloud.secretmanager.v1.SecretName;
+import com.google.cloud.secretmanager.v1.SecretPayload;
 import com.google.cloud.secretmanager.v1.SecretVersionName;
 import com.google.crypto.tink.subtle.Hkdf;
 import com.google.protobuf.ByteString;
@@ -104,7 +104,8 @@ public byte[] getSecretBytes() {
             secretVersionName.toString());
       }
 
-      SecretPayload payload = SecretPayload.newBuilder().setData(ByteString.copyFrom(newKey)).build();
+      SecretPayload payload =
+          SecretPayload.newBuilder().setData(ByteString.copyFrom(newKey)).build();
       client.addSecretVersion(secretName, payload);
       AccessSecretVersionResponse response = client.accessSecretVersion(secretVersionName);
       return response.getPayload().getData().toByteArray();

sdks/java/core/src/main/java/org/apache/beam/sdk/util/Secret.java

@@ -88,12 +88,30 @@ static Secret parseSecretOption(String secretOption) {
                     paramName, gcpHsmGeneratedSecretParams));
           }
         }
-        return new GcpHsmGeneratedSecret(
-            paramMap.get("project_id"),
-            paramMap.get("location_id"),
-            paramMap.get("key_ring_id"),
-            paramMap.get("key_id"),
-            paramMap.get("job_name"));
+        String projectId = paramMap.get("project_id");
+        if (projectId == null) {
+          throw new RuntimeException(
+              "project_id must contain a valid value for projectId parameter");
+        }
+        String locationId = paramMap.get("location_id");
+        if (locationId == null) {
+          throw new RuntimeException(
+              "location_id must contain a valid value for locationId parameter");
+        }
+        String keyRingId = paramMap.get("key_ring_id");
+        if (keyRingId == null) {
+          throw new RuntimeException(
+              "key_ring_id must contain a valid value for keyRingId parameter");
+        }
+        String keyId = paramMap.get("key_id");
+        if (keyId == null) {
+          throw new RuntimeException("key_id must contain a valid value for keyId parameter");
+        }
+        String jobName = paramMap.get("job_name");
+        if (jobName == null) {
+          throw new RuntimeException("job_name must contain a valid value for jobName parameter");
+        }
+        return new GcpHsmGeneratedSecret(projectId, locationId, keyRingId, keyId, jobName);
       default:
         throw new RuntimeException(
             String.format(

sdks/java/core/src/test/java/org/apache/beam/sdk/transforms/GroupByEncryptedKeyTest.java

@@ -152,8 +152,7 @@ public static void setup() throws IOException {
       keyId = "gbek-test-key-" + System.currentTimeMillis();
       com.google.cloud.kms.v1.CryptoKey key =
           com.google.cloud.kms.v1.CryptoKey.newBuilder()
-              .setPurpose(
-                  com.google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT)
+              .setPurpose(com.google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT)
               .build();
       kmsClient.createCryptoKey(keyRingName, keyId, key);
       gcpHsmGeneratedSecret =

sdks/java/core/src/test/java/org/apache/beam/sdk/transforms/GroupByKeyIT.java

@@ -17,7 +17,6 @@
  */
 package org.apache.beam.sdk.transforms;
 
-import com.google.cloud.secretmanager.v1.ProjectName;
 import com.google.cloud.kms.v1.CryptoKey;
 import com.google.cloud.kms.v1.CryptoKeyName;
 import com.google.cloud.kms.v1.CryptoKeyVersion;
@@ -111,9 +110,7 @@ public static void setup() throws IOException {
 
       keyId = "gbekit-key-" + new SecureRandom().nextInt(10000);
       CryptoKey key =
-          CryptoKey.newBuilder()
-              .setPurpose(CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT)
-              .build();
+          CryptoKey.newBuilder().setPurpose(CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT).build();
       kmsClient.createCryptoKey(keyRingName, keyId, key);
       gcpHsmSecretOption =
           String.format(