Commit 59b6abc
authored
chore: add warning for rsa library (#1925)
The `rsa` library is archived, and scheduled to be removed.
`google-auth` already supports an alternate implementation, using
`cryptography`. This PR adds a warning to users still relying on the old
library, and adds `rsa` as an optional dependency to allow users to
continue to opt-in to rsa during deprecation persion
After release, a follow-up version will remove rsa as a required
dependency, leaving it only for opt-in users1 parent 056642b commit 59b6abc
3 files changed
Lines changed: 28 additions & 0 deletions
File tree
- packages/google-auth
- google/auth/crypt
- tests/crypt
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -22,6 +22,7 @@ | |||
| 22 | 22 | from __future__ import absolute_import | |
| 23 | 23 | ||
| 24 | 24 | import io | |
| 25 | + import warnings | ||
| 25 | 26 | ||
| 26 | 27 | from pyasn1.codec.der import decoder # type: ignore | |
| 27 | 28 | from pyasn1_modules import pem # type: ignore | |
@@ -39,6 +40,15 @@ | |||
| 39 | 40 | _PKCS8_MARKER = ("-----BEGIN PRIVATE KEY-----", "-----END PRIVATE KEY-----") | |
| 40 | 41 | _PKCS8_SPEC = PrivateKeyInfo() | |
| 41 | 42 | ||
| 43 | + warnings.warn( | ||
| 44 | + ( | ||
| 45 | + "The 'rsa' library is deprecated and will be removed in a future release. " | ||
| 46 | + "Please migrate to 'cryptography'." | ||
| 47 | + ), | ||
| 48 | + category=DeprecationWarning, | ||
| 49 | + stacklevel=2, | ||
| 50 | + ) | ||
| 51 | + | ||
| 42 | 52 | ||
| 43 | 53 | def _bit_list_to_bytes(bit_list): | |
| 44 | 54 | """Converts an iterable of 1s and 0s to bytes. | |
@@ -64,6 +74,10 @@ def _bit_list_to_bytes(bit_list): | |||
| 64 | 74 | class RSAVerifier(base.Verifier): | |
| 65 | 75 | """Verifies RSA cryptographic signatures using public keys. | |
| 66 | 76 | ||
| 77 | + .. deprecated:: | ||
| 78 | + The `rsa` library has been archived. Please migrate to | ||
| 79 | + `cryptography`. | ||
| 80 | + | ||
| 67 | 81 | Args: | |
| 68 | 82 | public_key (rsa.key.PublicKey): The public key used to verify | |
| 69 | 83 | signatures. | |
@@ -116,6 +130,10 @@ def from_string(cls, public_key): | |||
| 116 | 130 | class RSASigner(base.Signer, base.FromServiceAccountMixin): | |
| 117 | 131 | """Signs messages with an RSA private key. | |
| 118 | 132 | ||
| 133 | + .. deprecated:: | ||
| 134 | + The `rsa` library has been archived. Please migrate to | ||
| 135 | + `cryptography`. | ||
| 136 | + | ||
| 119 | 137 | Args: | |
| 120 | 138 | private_key (rsa.key.PrivateKey): The private key to sign with. | |
| 121 | 139 | key_id (str): Optional key ID used to identify this private key. This | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -129,6 +129,7 @@ def unit(session): | |||
| 129 | 129 | "--cov-report=term-missing", | |
| 130 | 130 | "tests", | |
| 131 | 131 | "tests_async", | |
| 132 | + *session.posargs, | ||
| 132 | 133 | ) | |
| 133 | 134 | ||
| 134 | 135 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -191,3 +191,12 @@ def test_from_service_account_file(self): | |||
| 191 | 191 | ||
| 192 | 192 | assert signer.key_id == SERVICE_ACCOUNT_INFO[base._JSON_FILE_PRIVATE_KEY_ID] | |
| 193 | 193 | assert isinstance(signer._key, rsa.key.PrivateKey) | |
| 194 | + | ||
| 195 | + | ||
| 196 | + class TestModule(object): | ||
| 197 | + def test_import_warning(self): | ||
| 198 | + import importlib | ||
| 199 | + from google.auth.crypt import _python_rsa | ||
| 200 | + | ||
| 201 | + with pytest.warns(DeprecationWarning, match="The 'rsa' library is deprecated"): | ||
| 202 | + importlib.reload(_python_rsa) | ||
0 commit comments