fix!: replace rsa dependency with cryptography

[sai-sunder-s]

This commit removes the rsa library as a dependency and makes the cryptography library a required, core dependency.

Previously, cryptography was an optional dependency, and the library would fall back to a pure Python RSA implementation using the rsa library if cryptography was not installed.

Changes made:

• Modified setup.py to remove rsa from dependencies and add cryptography with version constraints.
• Updated google/auth/crypt/rsa.py to directly use the cryptography-based RSA implementation (_cryptography_rsa.py) and remove the fallback mechanism.
• Removed the pure Python RSA implementation file (google/auth/crypt/_python_rsa.py).
• Removed the corresponding tests for the pure Python RSA implementation (tests/crypt/test__python_rsa.py).

Core unit tests pass after these changes.

[parthea]

LGTM. We should mark this as fix instead of refactor so that the change to setup.py is visible in release notes.

fix: add dependency on cryptography
fix: drop dependency on rsa

[parthea]

Please could you file a bug for issue that requires this docs workaround, even if it will be closed with the changes in this PR. Add a link to the issue in this comment.

[parthea]

If this is not expected to happen, can we just let the error bubble up?

[parthea]

This code under this block is similar to the above if statement. Is it possible to refactor it?

[parthea]

Also remove rsa here:

google-auth-library-python/testing/constraints-3.7.txt

Line 11 in 25660bc

rsa==3.1.4

[HiromuHota]

Any update here? rsa (https://stuvel.eu/software/rsa/) is officially archived.

[daniel-sanche]

I looked a bit closer at the code, and it looks like this change would require a breaking change. Here's an example of some code that would break after this update:

import rsa as rsa_lib
import google.auth.crypt.rsa
# user didn't install optional `cryptography` dependency, so RSASigner and RSAVerifier 
# are imported from google.auth.crypt._python_rsa
signer = google.auth.crypt.rsa.RSASigner(priv_key)
verifier = google.auth.crypt.rsa.RSAVerifier(pub_key)

message = b"Test"

(pub_key, priv_key) = rsa_lib.newkeys(2048)
signature = signer.sign(message)
print(verifier.verify(message, signature))

I don't think there's a way to keep this flow consistent, without requiring rsa as a dependency

---

One thing we could do is make both rsa and cryptography optional dependencies, and raise an ImportError if both are missing? This would still be a breaking change, since they'll need to update their requirements.txt files. But they could keep using the rsa code in the mean-time.

I think it might be better to do a clean break from rsa though, since it's an archived package. I guess we could instruct users how to copy the old RSASigner/RSAVerifier classes into their codebase if they still want them