feat: setup.py: remove rsa requirement

[ktdreyer]

The rsa library is slower and not as well-maintained as the cryptography library. Now that we require the cryptography library, drop the hard requirement on the rsa library.

Fixes: #941

[arithmetic1728]

I think simply removing the rsa dependency will break the library since it is still in use: https://github.com/googleapis/google-auth-library-python/blob/main/google/auth/crypt/_python_rsa.py#L28

[ktdreyer]

Please see #646 , the code does not use python-rsa if python-cryptography is installed.

[ktdreyer]

This is still relevant because pip install google-auth still pulls in the old rsa library.

As I look at rebasing this today, I can remove the entry from setup.py, but it's now present in .kokoro/requirements.txt too. How do I make the change to that file?

[conventional-commit-lint-gcf]

🤖 I detect that the PR title and the commit message differ and there's only one commit. To use the PR title for the commit history, you can use Github's automerge feature with squashing, or use automerge label. Good luck human!

-- conventional-commit-lint bot
https://conventionalcommits.org/

[ktdreyer]

I researched kokoro to understand how to remove rsa from .kokoro/requirements.txt.

google-auth requires rsa, so we need to remove rsa from setup.py, then push a new release:

google-auth
  └rsa

The complicating factor is that .kokoro/requirements.in lists two modules that are not in setup.py: (gcp-docuploader and gcp-releasetool). These entries cause pip-compile to fetch google-auth=2.28.0 from PyPI. Because 2.28.0 still requires rsa, pip-compile still puts rsa into requirements.txt.

I think the solution here is to release a new google-auth version with this PR, then re-run pip-compile, and we should see the entry disappear from .kokoro/requirements.txt.

[prodigysml]

Any chance we can get some eyes on this one? There's a dependabot alert we can't get rid of, that would be fixed with this PR.

[miketheman]

This might need to be revived due to sybrenstuvel/python-rsa#245

[miketheman]

I think the build failure can be resolved by adding the missing rsa package to

google-auth-library-python/docs/conf.py

Line 375 in 56b4d3b

autodoc_mock_imports = ["grpc"]

Ref: https://www.sphinx-doc.org/en/master/usage/extensions/autodoc.html#confval-autodoc_mock_imports

That way, when sphinx autodoc traverses:

google.auth._jwt_async -> google.auth.jwt -> google.auth.crypt -> google.auth.crypt.rsa -> (sphinx follows fallback) google.auth.crypt._python_rsa -> import rsa

That final import to the missing rsa package will be ignored.

[ktdreyer]

FYI https://pypi.org/project/rsa/ has been formally archived, so I think we should land this change soon. This PR will stop the rsa package from showing up in dependency chains for apps that depend on this.

Once we release that, we can have a separate PR to drop google.auth.crypt._python_rsa altogether.

[tiran]

I would consider the use of rsa package as a security vulnerability. The rsa package implements the RSA algorithm with Python's built-in divmod function. divmod is not designed for cryptography and implements modulo division in a naive way. It's not constant timing, which makes rsa open to timing attacks (hello Bleichenbacher...).

rsa uses RSA blinding, but IMHO that's not good enough to address all potential timing attacks.

https://github.com/sybrenstuvel/python-rsa/blob/42b0e14ffbeeb9d99d1037e6440a2cc61780e4ea/CHANGELOG.md?plain=1#L78

[ktdreyer]

@parthea would you please merge this? It simply drops rsa from the list of mandatory requirements.

[daniel-sanche]

Thanks for putting this together and bringing it to our attention. I'll have to look into this a bit closer to make sure I understand the consequences of removing the dependency. Presumably, we'll need to add something else to provide a default implementation

[di]

There is a polyfill here that already prefers the pyca/cryptography implementation and only falls back to rsa if it is unavailable, so in effect there already is a "default" implementation.

google-auth-library-python/google/auth/crypt/rsa.py

Lines 18 to 30 in 56b4d3b

	try:
	# Prefer cryptograph-based RSA implementation.
	from google.auth.crypt import _cryptography_rsa
	RSASigner = _cryptography_rsa.RSASigner
	RSAVerifier = _cryptography_rsa.RSAVerifier
	except ImportError: # pragma: NO COVER
	# Fallback to pure-python RSA implementation if cryptography is
	# unavailable.
	from google.auth.crypt import _python_rsa
	RSASigner = _python_rsa.RSASigner # type: ignore
	RSAVerifier = _python_rsa.RSAVerifier # type: ignore

[daniel-sanche]

Yeah, I think we're going to have to make cryptography a default dependency instead of an optional. Closing this in favor of #1771, which is making that change. Thanks!