code: def backup(path, password_file=None):
      
      vault = VaultLib(get_vault_password(password_file))
      with open(path, 'r') as f:
          encrypted_data = f.read()
  
          # Normally we'd just try and catch the exception, but the
          # exception raised here is not very specific (just
          # `AnsibleError`), so this feels safer to avoid suppressing
          # other things that might go wrong.
          if vault.is_encrypted(encrypted_data):
              decrypted_data = vault.decrypt(encrypted_data)
  
              # Create atk vault files
              atk_path = os.path.join(ATK_VAULT, path)
              mkdir_p(atk_path)
              # ... encrypted
              with open(os.path.join(atk_path, 'encrypted'), 'wb') as f:
                  f.write(encrypted_data)
              # ... hash
              with open(os.path.join(atk_path, 'hash'), 'wb') as f:
                  f.write(hashlib.sha1(decrypted_data).hexdigest())
  
              # Replace encrypted file with decrypted one
              with open(path, 'wb') as f:
                  f.write(decrypted_data)
docs: Replaces the contents of a file with its decrypted counterpart, storing the
      original encrypted version and a hash of the file contents for later
      retrieval.