nethsm: Improve base64 handling and add key import from PEM

pynitrokey/cli/nethsm.py

@@ -37,6 +37,10 @@ def make_enum_type(enum_cls: EnumMeta) -> click.Choice:
     return click.Choice([variant.value for variant in enum_cls], case_sensitive=False)
 
 
+def base64_input(s: str) -> Base64:
+    return Base64.from_encoded(s, ignore_whitespace=True)
+
+
 API_CERTIFICATE_MIME_TYPE = "application/x-pem-file"
 KEY_CERTIFICATE_MIME_TYPES = [
     "application/x-pem-file",
@@ -688,9 +692,9 @@ def add_key(
         if not public_exponent:
             public_exponent = prompt_str("Public exponent")
         private_key = nethsm_sdk.RsaPrivateKey(
-            prime_p=Base64.from_encoded(prime_p),
-            prime_q=Base64.from_encoded(prime_q),
-            public_exponent=Base64.from_encoded(public_exponent),
+            prime_p=base64_input(prime_p),
+            prime_q=base64_input(prime_q),
+            public_exponent=base64_input(public_exponent),
         )
     else:
         if prime_p:
@@ -703,7 +707,7 @@ def add_key(
             )
         if not data:
             data = prompt_str("Key data")
-        private_key = nethsm_sdk.GenericPrivateKey(data=Base64.from_encoded(data))
+        private_key = nethsm_sdk.GenericPrivateKey(data=base64_input(data))
 
     with connect(ctx) as nethsm:
         key_id = nethsm.add_key(
@@ -716,6 +720,56 @@ def add_key(
         print(f"Key {key_id} added to NetHSM {nethsm.host}")
 
 
+@nethsm.command()
+@click.option(
+    "-m",
+    "--mechanism",
+    "mechanisms",
+    type=MECHANISM_TYPE,
+    multiple=True,
+    help="The mechanisms for the new key",
+)
+@click.option(
+    "--tags",
+    type=str,
+    multiple=True,
+    help="The tags for the new key",
+)
+@click.option(
+    "-k",
+    "--key-id",
+    help="The ID of the new key",
+)
+@click.argument("filename")
+@click.pass_context
+def import_key(
+    ctx: Context,
+    mechanisms: list[str],
+    tags: list[str],
+    key_id: Optional[str],
+    filename: str,
+) -> None:
+    """Import a key pair from a PEM file into the NetHSM.
+
+    If the key ID is not set, it is generated by the NetHSM.
+
+    This command requires authentication as a user with the Administrator
+    role."""
+    mechanisms = list(mechanisms)
+
+    with open(filename) as f:
+        private_key = f.read()
+
+    with connect(ctx) as nethsm:
+        key_id = nethsm.add_key_pem(
+            key_id=key_id,
+            mechanisms=[nethsm_sdk.KeyMechanism.from_string(m) for m in mechanisms],
+            tags=tags,
+            private_key=private_key,
+        )
+        print(f"Key {key_id} added to NetHSM {nethsm.host}")
+
+
 @nethsm.command()
 @click.option(
     "type",
@@ -1543,9 +1597,9 @@ def encrypt(ctx: Context, key_id: str, data: str, mode: str, iv: Optional[str])
     with connect(ctx) as nethsm:
         encrypted = nethsm.encrypt(
             key_id,
-            Base64.from_encoded(data),
+            base64_input(data),
             nethsm_sdk.EncryptMode.from_string(mode),
-            iv=Base64.from_encoded(iv) if iv else None,
+            iv=base64_input(iv) if iv else None,
         )
         print(f"Encrypted: {encrypted.encrypted.data}")
         print(f"Initialization vector: {encrypted.iv.data}")
@@ -1586,9 +1640,9 @@ def decrypt(ctx: Context, key_id: str, data: str, mode: str, iv: Optional[str])
     with connect(ctx) as nethsm:
         decrypted = nethsm.decrypt(
             key_id,
-            Base64.from_encoded(data),
+            base64_input(data),
             nethsm_sdk.DecryptMode.from_string(mode),
-            Base64.from_encoded(iv) if iv else None,
+            base64_input(iv) if iv else None,
         )
         print(decrypted.data)
 
@@ -1620,6 +1674,6 @@ def sign(ctx: Context, key_id: str, data: str, mode: str) -> None:
     This command requires authentication as a user with the Operator role."""
     with connect(ctx) as nethsm:
         signature = nethsm.sign(
-            key_id, Base64.from_encoded(data), nethsm_sdk.SignMode.from_string(mode)
+            key_id, base64_input(data), nethsm_sdk.SignMode.from_string(mode)
         )
         print(signature.data)

pyproject.toml

@@ -40,7 +40,7 @@ dependencies = [
   "protobuf >=3.17.3, < 4.0.0",
   "click-aliases",
   "semver",
-  "nethsm >= 1.0.0,<2",
+  "nethsm >= 1.1.0,<2",
 ]
 dynamic = ["version", "description"]