fix(google-auth): remove deprecated rsa dependency (#16020)

Coping over
googleapis/google-auth-library-python#1930 to
the new repo
This PR removes `rsa` as a required dependency, now that it has been
replaced with `cryptography` (with warnings issued)
This change has been released as [the 2.49.0.dev0
pre-release](https://pypi.org/project/google-auth/2.49.0.dev0/)
---------
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Author: daniel-sanche

packages/google-auth/google/auth/crypt/rsa.py

@@ -24,7 +24,6 @@
 
 fromgoogle.authimport_helpers
 fromgoogle.auth.cryptimport_cryptography_rsa
-fromgoogle.auth.cryptimport_python_rsa
 fromgoogle.auth.cryptimportbase
 
 RSA_KEY_MODULE_PREFIX="rsa.key"
@@ -37,6 +36,7 @@ class RSAVerifier(base.Verifier):
  public_key (Union["rsa.key.PublicKey", cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey]):
  The public key used to verify signatures.
  Raises:
+ ImportError: if called with an rsa.key.PublicKey, when the rsa library is not installed
  ValueError: if an unrecognized public key is provided
  """
 
@@ -45,6 +45,8 @@ def __init__(self, public_key):
 ifisinstance(public_key, RSAPublicKey):
 impl_lib=_cryptography_rsa
 elifmodule_str.startswith(RSA_KEY_MODULE_PREFIX):
+fromgoogle.auth.cryptimport_python_rsa
+
 impl_lib=_python_rsa
 else:
 raiseValueError(f"unrecognized public key type: {type(public_key)}")
@@ -85,6 +87,7 @@ class RSASigner(base.Signer, base.FromServiceAccountMixin):
  public key or certificate.
 
  Raises:
+ ImportError: if called with an rsa.key.PrivateKey, when the rsa library is not installed
  ValueError: if an unrecognized public key is provided
  """
 
@@ -93,6 +96,8 @@ def __init__(self, private_key, key_id=None):
 ifisinstance(private_key, RSAPrivateKey):
 impl_lib=_cryptography_rsa
 elifmodule_str.startswith(RSA_KEY_MODULE_PREFIX):
+fromgoogle.auth.cryptimport_python_rsa
+
 impl_lib=_python_rsa
 else:
 raiseValueError(f"unrecognized private key type: {type(private_key)}")

packages/google-auth/noxfile.py

@@ -41,7 +41,7 @@
 "3.13",
 "3.14",
 ]
-ALL_PYTHON=UNIT_TEST_PYTHON_VERSIONS
+ALL_PYTHON=UNIT_TEST_PYTHON_VERSIONS.copy()
 ALL_PYTHON.extend(["3.7"])
 
 # Error if a python version is missing
@@ -100,7 +100,7 @@ def blacken(session):
 @nox.session(python=DEFAULT_PYTHON_VERSION)
 defmypy(session):
 """Verify type hints are mypy compatible."""
-session.install("-e", ".[aiohttp]")
+session.install("-e", ".[aiohttp,rsa]")
 session.install(
 "mypy",
 "types-certifi",
@@ -115,16 +115,29 @@ def mypy(session):
 
 
 @nox.session(python=ALL_PYTHON)
-defunit(session):
+@nox.parametrize(["install_deprecated_extras"], (True, False))
+defunit(session, install_deprecated_extras):
 # Install all test dependencies, then install this package in-place.
 
 ifsession.pythonin ("3.7",):
 session.skip("Python 3.7 is no longer supported")
+min_py, max_py=UNIT_TEST_PYTHON_VERSIONS[0], UNIT_TEST_PYTHON_VERSIONS[-1]
+ifnotinstall_deprecated_extrasandsession.pythonnotin (min_py, max_py):
+# only run double tests on first and last supported versions
+session.skip(
+f"Extended tests only run on boundary Python versions ({min_py}, {max_py}) to reduce CI load."
+ )
 
 constraints_path=str(
 CURRENT_DIRECTORY/"testing"/f"constraints-{session.python}.txt"
  )
-session.install("-e", ".[testing]", "-c", constraints_path)
+extras_str="testing"
+ifinstall_deprecated_extras:
+# rsa and oauth2client were both archived and support dropped,
+# but we still test old code paths
+session.install("oauth2client")
+extras_str+=",rsa"
+session.install("-e", f".[{extras_str}]", "-c", constraints_path)
 session.run(
 "pytest",
 f"--junitxml=unit_{session.python}_sponge_log.xml",

packages/google-auth/setup.py

@@ -25,9 +25,6 @@
 DEPENDENCIES= (
 "pyasn1-modules>=0.2.1",
 cryptography_base_require,
-# TODO: remove rsa from dependencies in next release (replaced with cryptography)i
-# https://github.com/googleapis/google-auth-library-python/issues/1810
-"rsa>=3.1.4,<5",
 )
 
 requests_extra_require= ["requests >= 2.20.0, < 3.0.0"]
@@ -46,14 +43,14 @@
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1739): Add bounds for urllib3 and packaging dependencies.
 urllib3_extra_require= ["urllib3", "packaging"]
 
+rsa_extra_require= ["rsa>=3.1.4,<5"]
+
 # Unit test requirements.
 testing_extra_require= [
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1735): Remove `grpcio` from testing requirements once an extra is added for `grpcio` dependency.
 "grpcio",
 "flask",
 "freezegun",
-# TODO(https://github.com/googleapis/google-auth-library-python/issues/1736): Remove `oauth2client` from testing requirements once an extra is added for `oauth2client` dependency.
-"oauth2client",
 *pyjwt_extra_require,
 "pytest",
 "pytest-cov",
@@ -86,6 +83,7 @@
 "requests": requests_extra_require,
 "testing": testing_extra_require,
 "urllib3": urllib3_extra_require,
+"rsa": rsa_extra_require,
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1735): Add an extra for `grpcio` dependency.
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1736): Add an extra for `oauth2client` dependency.
 }

packages/google-auth/testing/constraints-3.8.txt

@@ -7,7 +7,6 @@
 # Then this file should have foo==1.14.0
 pyasn1-modules==0.2.1
 setuptools==40.3.0
-rsa==3.1.4
 cryptography==38.0.3
 aiohttp==3.6.2
 requests==2.20.0

packages/google-auth/tests/crypt/test__python_rsa.py

@@ -19,7 +19,11 @@
 
 frompyasn1_modulesimportpem# type: ignore
 importpytest# type: ignore
-importrsa# type: ignore
+
+try:
+importrsa
+exceptImportError:
+pytest.skip("rsa module not available", allow_module_level=True)
 
 fromgoogle.authimport_helpers
 fromgoogle.auth.cryptimport_python_rsa

packages/google-auth/tests/crypt/test_rsa.py

@@ -18,10 +18,15 @@
 fromcryptography.hazmatimportbackends
 fromcryptography.hazmat.primitivesimportserialization
 importpytest
-importrsaasrsa_lib
+
+try:
+importrsaasrsa_lib
+fromgoogle.auth.cryptimport_python_rsa
+exceptImportError:
+rsa_lib=None# type: ignore
+_pyrhon_rsa=None# type: ignore
 
 fromgoogle.auth.cryptimport_cryptography_rsa
-fromgoogle.auth.cryptimport_python_rsa
 fromgoogle.auth.cryptimportrsa
 
 
@@ -70,11 +75,13 @@ def test_init_with_cryptography_key(self, cryptography_public_key):
 assertisinstance(verifier._impl, _cryptography_rsa.RSAVerifier)
 assertverifier._impl._pubkey==cryptography_public_key
 
+@pytest.mark.skipif(notrsa_lib, reason="rsa library not installed")
 deftest_init_with_rsa_key(self, rsa_public_key):
 verifier=rsa.RSAVerifier(rsa_public_key)
 assertisinstance(verifier._impl, _python_rsa.RSAVerifier)
 assertverifier._impl._pubkey==rsa_public_key
 
+@pytest.mark.skipif(notrsa_lib, reason="rsa library not installed")
 deftest_warning_with_rsa(self, rsa_public_key):
 withpytest.warns(DeprecationWarning, match="The 'rsa' library is deprecated"):
 rsa.RSAVerifier(rsa_public_key)
@@ -114,12 +121,14 @@ def test_init_with_cryptography_key(self, cryptography_private_key):
 assertsigner._impl._key==cryptography_private_key
 assertsigner._impl.key_id=="123"
 
+@pytest.mark.skipif(notrsa_lib, reason="rsa library not installed")
 deftest_init_with_rsa_key(self, rsa_private_key):
 signer=rsa.RSASigner(rsa_private_key, key_id="123")
 assertisinstance(signer._impl, _python_rsa.RSASigner)
 assertsigner._impl._key==rsa_private_key
 assertsigner._impl.key_id=="123"
 
+@pytest.mark.skipif(notrsa_lib, reason="rsa library not installed")
 deftest_warning_with_rsa(self, rsa_private_key):
 withpytest.warns(DeprecationWarning, match="The 'rsa' library is deprecated"):
 rsa.RSASigner(rsa_private_key, key_id="123")
@@ -130,8 +139,8 @@ def test_init_with_unknown_key(self):
 withpytest.raises(ValueError):
 rsa.RSASigner(unknown_key)
 
-deftest_sign_delegates(self, rsa_private_key):
-signer=rsa.RSASigner(rsa_private_key)
+deftest_sign_delegates(self, cryptography_private_key):
+signer=rsa.RSASigner(cryptography_private_key)
 
 withmock.patch.object(
 signer._impl, "sign", return_value=b"signature"
@@ -164,6 +173,7 @@ def test_end_to_end_cryptography_lib(self, private_key_bytes, public_key_bytes):
 assertisinstance(verifier._impl, _cryptography_rsa.RSAVerifier)
 assertisinstance(signer._impl, _cryptography_rsa.RSASigner)
 
+@pytest.mark.skipif(notrsa_lib, reason="rsa library not installed")
 deftest_end_to_end_rsa_lib(self, rsa_private_key, rsa_public_key):
 signer=rsa.RSASigner(rsa_private_key)
 message=b"Hello World"