def encrypt(source_text, passphrase, debug_stmt=None):
if debug_stmt is None:<EOL><INDENT>debug_stmt = "<STR_LIT>"<EOL><DEDENT>prefix = b'<STR_LIT>'<EOL>salt = os.urandom(IV_BLOCK_SIZE - len(prefix))<EOL>key, iv_ = _openssl_key_iv(passphrase, salt)<EOL>cipher = Cipher(<EOL>algorithms.AES(key), modes.CBC(iv_), default_backend()<EOL>).encryptor()<EOL>if hasattr(source_text, '<STR_LIT>'):<EOL><INDENT>source_utf8 = source_text.encode('<STR_LIT:utf-8>')<EOL><DEDENT>else:<EOL><INDENT>source_utf8 = str(source_text)<EOL><DEDENT>padding = (IV_BLOCK_SIZE - len(source_utf8) % IV_BLOCK_SIZE)<EOL>if six.PY2:<EOL><INDENT>padding = chr(padding) * padding<EOL><DEDENT>else:<EOL><INDENT>padding = bytes([padding for _ in range(padding)])<EOL><DEDENT>plain_text = source_utf8 + padding<EOL>encrypted_text = cipher.update(plain_text) + cipher.finalize()<EOL>full_encrypted = b64encode(prefix + salt + encrypted_text)<EOL>_log_debug(salt, key, iv_, full_encrypted, source_text,<EOL>passphrase=passphrase, debug_stmt=debug_stmt)<EOL>return full_encrypted<EOL>
Returns *source_text* as a base64 AES encrypted string.

The full encrypted text is special crafted to be compatible
with openssl. It can be decrypted with:

    $ echo _full_encypted_ | openssl aes-256-cbc -d -a -k _passphrase_ -p
    salt=...
    key=...
    iv=...
    _source_text_