def encrypt(source_text, passphrase, debug_stmt=None):
    """
    Returns *source_text* as a base64 AES encrypted string.

    The full encrypted text is special crafted to be compatible
    with openssl. It can be decrypted with:

        $ echo _full_encypted_ | openssl aes-256-cbc -d -a -k _passphrase_ -p
        salt=...
        key=...
        iv=...
        _source_text_
    """
    if debug_stmt is None:
        debug_stmt = "encrypt"
    prefix = b'Salted__'
    salt = os.urandom(IV_BLOCK_SIZE - len(prefix))
    key, iv_ = _openssl_key_iv(passphrase, salt)
    cipher = Cipher(
        algorithms.AES(key), modes.CBC(iv_), default_backend()
    ).encryptor()

    # PKCS#7 padding
    if hasattr(source_text, 'encode'):
        source_utf8 = source_text.encode('utf-8')
    else:
        source_utf8 = str(source_text)
    padding = (IV_BLOCK_SIZE - len(source_utf8) % IV_BLOCK_SIZE)
    if six.PY2:
        padding = chr(padding) * padding
    else:
        padding = bytes([padding for _ in range(padding)])
    plain_text = source_utf8 + padding
    encrypted_text = cipher.update(plain_text) + cipher.finalize()
    full_encrypted = b64encode(prefix + salt + encrypted_text)
    _log_debug(salt, key, iv_, full_encrypted, source_text,
        passphrase=passphrase, debug_stmt=debug_stmt)
    return full_encrypted