feat: auto-detect ML-DSA keys in service account JSON credentials · googleapis/google-cloud-python@8bd2f74 · GitHub

googleapis / google-cloud-python Public

• Notifications You must be signed in to change notification settings
• Fork 1.8k
• Star 5.4k

• Code
• Issues 442
• Pull requests 97
• Discussions
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit 8bd2f74

Browse filesBrowse the repository at this point in the historyBrowse files

ohmayr

committed

feat: auto-detect ML-DSA keys in service account JSON credentials

1 parent f602d58 commit 8bd2f74
Copy full SHA for 8bd2f74

2 files changed

+90Lines changed: 90 additions & 0 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• packages/google-auth
  • google/auth
    • _service_account_info.py
  • tests
    • test__service_account_info.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎packages/google-auth/google/auth/_service_account_info.py‎

Copy file name to clipboardExpand all lines: packages/google-auth/google/auth/_service_account_info.py

+7Lines changed: 7 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -53,6 +53,13 @@ def from_dict(data, require=None, use_rsa_signer=True):
53	53	)
54	54
55	55	# Create a signer.
	56	+ if (
	57	+ isinstance(data, dict)
	58	+ and isinstance(data.get("private_key"), str)
	59	+ and crypt.is_mldsa_key(data["private_key"])
	60	+ ):
	61	+ return crypt.PqcSigner.from_service_account_info(data)
	62	+
56	63	if use_rsa_signer:
57	64	signer = crypt.RSASigner.from_service_account_info(data)
58	65	else:

Collapse file

‎packages/google-auth/tests/test__service_account_info.py‎

Copy file name to clipboardExpand all lines: packages/google-auth/tests/test__service_account_info.py

+83Lines changed: 83 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -12,8 +12,10 @@
12	12	# See the License for the specific language governing permissions and
13	13	# limitations under the License.
14	14
	15	+ import base64
15	16	import json
16	17	import os
	18	+ from unittest import mock
17	19
18	20	import pytest # type: ignore
19	21
@@ -107,3 +109,84 @@ def test_from_filename_es384_signer():
107	109	assert isinstance(signer, crypt.EsSigner)
108	110	assert signer.key_id == GDCH_SERVICE_ACCOUNT_ES384_INFO["private_key_id"]
109	111	assert signer.algorithm == "ES384"
	112	+
	113	+
	114	+ def test_from_dict_mldsa_signer_auto_detect_upgrade_required(monkeypatch):
	115	+ if crypt.pqc is not None:
	116	+ monkeypatch.setattr(crypt.pqc, "mldsa", None)
	117	+ else:
	118	+ mock_pqc = mock.Mock()
	119	+ mock_pqc.mldsa = None
	120	+ mock_pqc.is_mldsa_key = lambda key: True
	121	+ mock_pqc.PqcSigner.from_service_account_info = mock.Mock(
	122	+ side_effect=RuntimeError(
	123	+ "Post-Quantum ML-DSA Service Account keys require cryptography>=47.0.0. "
	124	+ "Please upgrade your cryptography library (pip install 'cryptography>=47.0.0')."
	125	+ )
	126	+ )
	127	+ monkeypatch.setattr(crypt, "pqc", mock_pqc)
	128	+
	129	+ der_bytes = (
	130	+ b"\x30\x20\x02\x01\x00\x30\x0b"
	131	+ b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x03\x12"
	132	+ b"\x04\x0a\x04\x08\x00\x00\x00\x00\x00\x00\x00\x00"
	133	+ )
	134	+ b64_key = base64.b64encode(der_bytes).decode("ascii")
	135	+ mldsa_pem = f"-----BEGIN PRIVATE KEY-----\n{b64_key}\n-----END PRIVATE KEY-----"
	136	+ info = {
	137	+ "private_key": mldsa_pem,
	138	+ "private_key_id": "test_mldsa_key_id",
	139	+ "client_email": "test@example.com",
	140	+ }
	141	+ with pytest.raises(RuntimeError) as excinfo:
	142	+ _service_account_info.from_dict(info)
	143	+
	144	+ assert (
	145	+ "Post-Quantum ML-DSA Service Account keys require cryptography>=47.0.0"
	146	+ in str(excinfo.value)
	147	+ )
	148	+ assert (
	149	+ "Please upgrade your cryptography library (pip install 'cryptography>=47.0.0')"
	150	+ in str(excinfo.value)
	151	+ )
	152	+
	153	+
	154	+ def test_from_dict_mldsa_signer_auto_detect_success(monkeypatch):
	155	+ class MockMLDSA65PrivateKey:
	156	+ pass
	157	+
	158	+ mock_mldsa = mock.Mock()
	159	+ mock_mldsa.MLDSA65PrivateKey = MockMLDSA65PrivateKey
	160	+
	161	+ der_bytes = (
	162	+ b"\x30\x20\x02\x01\x00\x30\x0b"
	163	+ b"\x06\x09\x60\x86\x48\x01\x65\x03\x04\x03\x12"
	164	+ b"\x04\x0a\x04\x08\x00\x00\x00\x00\x00\x00\x00\x00"
	165	+ )
	166	+ b64_key = base64.b64encode(der_bytes).decode("ascii")
	167	+ mldsa_pem = f"-----BEGIN PRIVATE KEY-----\n{b64_key}\n-----END PRIVATE KEY-----"
	168	+ info = {
	169	+ "private_key": mldsa_pem,
	170	+ "private_key_id": "test_mldsa_key_id",
	171	+ "client_email": "test@example.com",
	172	+ }
	173	+
	174	+ if crypt.pqc is not None:
	175	+ monkeypatch.setattr(crypt.pqc, "mldsa", mock_mldsa)
	176	+ monkeypatch.setattr(
	177	+ crypt.pqc.serialization,
	178	+ "load_pem_private_key",
	179	+ lambda key, password, backend: MockMLDSA65PrivateKey(),
	180	+ )
	181	+ else:
	182	+ mock_pqc = mock.Mock()
	183	+ mock_pqc.mldsa = mock_mldsa
	184	+ mock_pqc.is_mldsa_key = lambda key: True
	185	+ mock_pqc.PqcSigner.from_service_account_info = mock.Mock(
	186	+ return_value=mock.Mock(key_id="test_mldsa_key_id", algorithm="ML-DSA-65")
	187	+ )
	188	+ monkeypatch.setattr(crypt, "pqc", mock_pqc)
	189	+
	190	+ signer = _service_account_info.from_dict(info)
	191	+ assert signer.key_id == "test_mldsa_key_id"
	192	+ assert signer.algorithm == "ML-DSA-65"

0 commit comments

Comments

0 (0)