Problem

We need some way for the CLI to provide the encryption context as output to the caller.

Solution

The CLI will accept three possible new arguments that will control output. Exactly one of these can be provided on each call.

• --suppress-metadata : Suppresses metadata output.
• --write-metadata FILE: Overwrites FILE with metadata output.
• --append-metadata FILE : Appends metadata output to FILE.

Each line written consists of JSON-formatted metadata about a single operation. Fields in this metadata will include:

• input : - or full path to input file
• output : - or full path to output file
• encryption_context : string-string JSON map of the encryption context

Additional metadata values might be added to this structure in the future.

Requirements:

• The user must specify the filename.
• If output is a directory, the filename cannot be within that directory.
• Filename cannot be in input directory or files.