key-transform 1.0.1__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. key_transform/__init__.py +0 -0
  2. key_transform/main.py +146 -0
  3. key_transform-1.0.1.dist-info/METADATA +124 -0
  4. key_transform-1.0.1.dist-info/RECORD +7 -0
  5. key_transform-1.0.1.dist-info/WHEEL +4 -0
  6. key_transform-1.0.1.dist-info/entry_points.txt +2 -0
  7. key_transform-1.0.1.dist-info/licenses/LICENSE +21 -0
key_transform/__init__.py ADDED
File without changes
key_transform/main.py ADDED
@@ -0,0 +1,146 @@
1
+ from __future__ import annotations
2
+
3
+ from typing import IO
4
+
5
+ import click
6
+ import pgpy
7
+ import pgpy.constants
8
+ from cryptography.hazmat.primitives.asymmetric import ec, rsa
9
+ from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
10
+ from cryptography.hazmat.primitives.serialization import (
11
+ BestAvailableEncryption,
12
+ Encoding,
13
+ PrivateFormat,
14
+ PublicFormat,
15
+ )
16
+ from pgpy.constants import KeyFlags
17
+
18
+
19
+ class TransformError(Exception):
20
+ pass
21
+
22
+
23
+ @click.group(context_settings={"max_content_width": 120})
24
+ def cli() -> None:
25
+ pass
26
+
27
+
28
+ def output_ssh_key(
29
+ pgp_key: pgpy.PGPKey, key: ec.EllipticCurvePrivateKey | Ed25519PrivateKey | rsa.RSAPrivateKey, export_password: str
30
+ ) -> None:
31
+ pubkey = key.public_key()
32
+ pubkey_format = pubkey.public_bytes(encoding=Encoding.OpenSSH, format=PublicFormat.OpenSSH)
33
+ privkey_format_pkcs8 = key.private_bytes(
34
+ encoding=Encoding.PEM,
35
+ format=PrivateFormat.PKCS8,
36
+ encryption_algorithm=BestAvailableEncryption(export_password.encode()),
37
+ )
38
+ privkey_format_openssh = key.private_bytes(
39
+ encoding=Encoding.PEM,
40
+ format=PrivateFormat.OpenSSH,
41
+ encryption_algorithm=BestAvailableEncryption(export_password.encode()),
42
+ )
43
+ print(f" PGP Private Key {pgp_key.fingerprint} {pgp_key.key_algorithm.name} {pgp_key.key_size!s} ".center(120, "#"))
44
+ print(f"# SSH Pubkey:\n{pubkey_format.decode('ascii')}\n")
45
+ print("# PKCS8 Private Key:")
46
+ print(privkey_format_pkcs8.decode("ascii"))
47
+ print("# OpenSSH Private Key:")
48
+ print(privkey_format_openssh.decode("ascii"))
49
+ print("#" * 120)
50
+
51
+
52
+ def _transform_ecdsa(privkey: pgpy.PGPKey) -> ec.EllipticCurvePrivateKey:
53
+ keymaterial = privkey.__key__
54
+ return ec.derive_private_key(keymaterial.s, keymaterial.oid.curve())
55
+
56
+
57
+ def _transform_ed25519(privkey: pgpy.PGPKey) -> Ed25519PrivateKey:
58
+ keymaterial = privkey.__key__
59
+ return Ed25519PrivateKey.from_private_bytes(keymaterial.p.x)
60
+
61
+
62
+ def _transform_rsa(privkey: pgpy.PGPKey) -> rsa.RSAPrivateKey:
63
+ keymaterial = privkey.__key__
64
+ dmp1 = rsa.rsa_crt_dmp1(keymaterial.d, keymaterial.p)
65
+ dmq1 = rsa.rsa_crt_dmq1(keymaterial.d, keymaterial.q)
66
+ iqmp = rsa.rsa_crt_iqmp(keymaterial.p, keymaterial.q)
67
+ public_numbers = rsa.RSAPublicNumbers(e=keymaterial.e, n=keymaterial.n)
68
+ privkey_numbers = rsa.RSAPrivateNumbers(
69
+ p=keymaterial.p,
70
+ q=keymaterial.q,
71
+ d=keymaterial.d,
72
+ dmp1=dmp1,
73
+ dmq1=dmq1,
74
+ iqmp=iqmp,
75
+ public_numbers=public_numbers,
76
+ )
77
+ return privkey_numbers.private_key()
78
+
79
+
80
+ def parse_subkeys(privkey: pgpy.PGPKey, export_password: str) -> None:
81
+ for k in privkey.subkeys.values():
82
+ for sig in k.self_signatures:
83
+ if KeyFlags.Authentication in sig.key_flags:
84
+ if k.key_algorithm == pgpy.constants.PubKeyAlgorithm.ECDSA:
85
+ output_ssh_key(k, _transform_ecdsa(k), export_password)
86
+ elif (
87
+ k.key_algorithm == pgpy.constants.PubKeyAlgorithm.EdDSA
88
+ and k.key_size == pgpy.constants.EllipticCurveOID.Ed25519
89
+ ):
90
+ output_ssh_key(k, _transform_ed25519(k), export_password)
91
+ elif k.key_algorithm in [
92
+ pgpy.constants.PubKeyAlgorithm.RSAEncryptOrSign,
93
+ pgpy.constants.PubKeyAlgorithm.RSAEncrypt,
94
+ pgpy.constants.PubKeyAlgorithm.RSASign,
95
+ ]:
96
+ output_ssh_key(k, _transform_rsa(k), export_password)
97
+
98
+
99
+ @cli.command()
100
+ @click.argument("pgp-key", type=click.File("rb"))
101
+ @click.option(
102
+ "--export-password",
103
+ prompt=True,
104
+ hide_input=True,
105
+ confirmation_prompt=True,
106
+ envvar="EXPORT_PASSWORD",
107
+ help="Password for the exported SSL/SSH private key.",
108
+ show_envvar=True,
109
+ )
110
+ @click.option(
111
+ "--import-password",
112
+ prompt=True,
113
+ hide_input=True,
114
+ confirmation_prompt=True,
115
+ envvar="IMPORT_PASSWORD",
116
+ help="Password for the imported PGP key.",
117
+ show_envvar=True,
118
+ )
119
+ def transform(pgp_key: IO, export_password: str, import_password: str) -> None:
120
+ """
121
+ Transforms an OpenPGP key to OpenSSL / OpenSSH
122
+
123
+ To provide an OpenPGP key, use `gpg --export-ssh-key <keyid>`.
124
+
125
+ This tool will extract all subkeys with the "Authentication" flag set.
126
+ """
127
+ keyblob = pgp_key.read()
128
+ try:
129
+ privkey, _ = pgpy.PGPKey.from_blob(keyblob)
130
+ except ValueError:
131
+ msg = "Input is not a valid PGP key"
132
+ raise TransformError(msg) from None
133
+ if privkey.is_public:
134
+ msg = "Input needs to be a private key"
135
+ raise TransformError(msg)
136
+ if privkey.is_protected:
137
+ if not import_password:
138
+ import_password = click.prompt("PGP Key Password", hide_input=True)
139
+ with privkey.unlock(import_password):
140
+ parse_subkeys(privkey, export_password)
141
+ else:
142
+ parse_subkeys(privkey, export_password)
143
+
144
+
145
+ if __name__ == "__main__":
146
+ cli()
key_transform-1.0.1.dist-info/METADATA ADDED
@@ -0,0 +1,124 @@
1
+ Metadata-Version: 2.4
2
+ Name: key-transform
3
+ Version: 1.0.1
4
+ Summary: Transforms an OpenPGP private key to OpenSSL / OpenSSH format
5
+ Project-URL: homepage, https://gitlab.com/sebastianw/key-transform/
6
+ Project-URL: repository, https://gitlab.com/sebastianw/key-transform/
7
+ Author-email: Sebastian Wiesinger <sebastian@karotte.org>
8
+ License-Expression: MIT
9
+ License-File: LICENSE
10
+ Classifier: Development Status :: 4 - Beta
11
+ Classifier: Environment :: Console
12
+ Classifier: License :: OSI Approved :: MIT License
13
+ Classifier: Programming Language :: Python :: 3 :: Only
14
+ Classifier: Programming Language :: Python :: 3.13
15
+ Classifier: Programming Language :: Python :: 3.14
16
+ Classifier: Topic :: Internet
17
+ Classifier: Topic :: Security
18
+ Classifier: Topic :: Security :: Cryptography
19
+ Classifier: Topic :: Utilities
20
+ Requires-Python: >=3.13
21
+ Requires-Dist: bcrypt>=5
22
+ Requires-Dist: click>=8.3.1
23
+ Requires-Dist: cryptography>=46.0.4
24
+ Requires-Dist: pgpy13>=0.6.1rc1; python_full_version >= '3.13'
25
+ Requires-Dist: pgpy; python_full_version < '3.13'
26
+ Description-Content-Type: text/markdown
27
+
28
+ key-transform
29
+ =============
30
+
31
+ Transforms an OpenPGP key to PKCS#8 and OpenSSH key format.
32
+
33
+ Supports RSA, ECDSA and ED25519 keys.
34
+
35
+ ## Installation
36
+
37
+ Install via pipx or uv tool
38
+
39
+ ```shell
40
+ uv tool install key-transform
41
+ # OR
42
+ pipx install key-transform
43
+ ```
44
+
45
+ ## Usage
46
+
47
+ ```shell
48
+ # Lookup secret key(s) and note key fingerprint
49
+ gpg -K
50
+ ~/.gnupg/pubring.kbx
51
+ -------------------------------------------------------------
52
+ sec ed25519 2026-02-06 [SC]
53
+ 972ACF51A09C0259060CFA035432496985998071
54
+ uid [ultimate] Test Key <test@example.com>
55
+ ssb cv25519 2026-02-06 [E]
56
+ ssb rsa3072 2026-02-06 [A]
57
+ ssb ed25519 2026-02-06 [A]
58
+ ssb nistp256 2026-02-06 [A]
59
+
60
+ # Export the key
61
+ gpg --export-secret-key 972ACF51A09C0259060CFA035432496985998071 > secret_key.gpg
62
+
63
+ # Transform the key, output will be PKCS#8 and OpenSSH format
64
+ key-transform transform secret_key.gpg
65
+
66
+ #################### PGP Private Key 3F745041AAFE4699CB6FB57F3E311D69E96ADFDD RSAEncryptOrSign 3072 ####################
67
+ # SSH Pubkey:
68
+ ssh-rsa AAAAB3NzaC1yc2[...]
69
+
70
+ # PKCS8 Private Key:
71
+ -----BEGIN ENCRYPTED PRIVATE KEY-----
72
+ MIIHdTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQmv1ATOwwehUv7yd6
73
+ [...]
74
+ Nu6faDf4tiJQCfrBP0OL8Rt4yJTSHk79IZe8tysYfYVc01jl119v3Cc=
75
+ -----END ENCRYPTED PRIVATE KEY-----
76
+
77
+ # OpenSSH Private Key:
78
+ -----BEGIN OPENSSH PRIVATE KEY-----
79
+ b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABC4U2kyj10gkOYW
80
+ [...]
81
+ OxarmihrTQIcdQpD0Ts1NrV9A/eg3Pua+FRmuVVzfY+fT8bP5+ztIQ5SDmcxmDwNLGDY5vD6jcR0
82
+ q2Sf5Fl7k1uKj1QmPA==
83
+ -----END OPENSSH PRIVATE KEY-----
84
+
85
+ ########################################################################################################################
86
+ ############### PGP Private Key 82080A5C69729B254E767F10030959F32C2268B7 EdDSA EllipticCurveOID.Ed25519 ################
87
+ # SSH Pubkey:
88
+ ssh-ed25519 AAAAC3Nza[...]
89
+
90
+ # PKCS8 Private Key:
91
+ -----BEGIN ENCRYPTED PRIVATE KEY-----
92
+ MIGjMF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBB+N0mJLilE1jtYvYNO
93
+ [...]
94
+ FmvKKIRiopWgsjUIgcPLRyoDWLdzKg==
95
+ -----END ENCRYPTED PRIVATE KEY-----
96
+
97
+ # OpenSSH Private Key:
98
+ -----BEGIN OPENSSH PRIVATE KEY-----
99
+ b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCUuri5leG0RFKe
100
+ [...]
101
+ K5+JAItSAMQnM9LV5g4PT6nn56VtsSaM3dF+PM0lSoeJDNkR/6pZ7LLyphCwKQ==
102
+ -----END OPENSSH PRIVATE KEY-----
103
+
104
+ ########################################################################################################################
105
+ ############## PGP Private Key 963E77E42934A3BD5EDB2139527CD0C853415507 ECDSA EllipticCurveOID.NIST_P256 ###############
106
+ # SSH Pubkey:
107
+ ecdsa-sha2-nistp256 AAAAE2VjZH[...]
108
+
109
+ # PKCS8 Private Key:
110
+ -----BEGIN ENCRYPTED PRIVATE KEY-----
111
+ MIH0MF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBA1GnMpIItB3JYv51b9
112
+ [...]
113
+ PZn5p3E77Q==
114
+ -----END ENCRYPTED PRIVATE KEY-----
115
+
116
+ # OpenSSH Private Key:
117
+ -----BEGIN OPENSSH PRIVATE KEY-----
118
+ b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCqT2tcZRsyufkT
119
+ [...]
120
+ bg==
121
+ -----END OPENSSH PRIVATE KEY-----
122
+
123
+ ########################################################################################################################
124
+ ```
key_transform-1.0.1.dist-info/RECORD ADDED
@@ -0,0 +1,7 @@
1
+ key_transform/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
2
+ key_transform/main.py,sha256=HX7AkRJhpi6WIt4Z_0DZKsoKheknZMyAzKNjfUmyKYI,4968
3
+ key_transform-1.0.1.dist-info/METADATA,sha256=WcLRz4IP2eHVsnt66kczyE8Jvfw8U4uCHLJoosMMRtU,4088
4
+ key_transform-1.0.1.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
5
+ key_transform-1.0.1.dist-info/entry_points.txt,sha256=sBhPmyqY8B18-0iMYmLozSgLHLvqrWQaSEyNWnjmFQs,57
6
+ key_transform-1.0.1.dist-info/licenses/LICENSE,sha256=cehVwANM7Ib8EuzpNsuOndhL5EHMFma2YyUKjkSBrhM,1076
7
+ key_transform-1.0.1.dist-info/RECORD,,
key_transform-1.0.1.dist-info/WHEEL ADDED
@@ -0,0 +1,4 @@
1
+ Wheel-Version: 1.0
2
+ Generator: hatchling 1.28.0
3
+ Root-Is-Purelib: true
4
+ Tag: py3-none-any
key_transform-1.0.1.dist-info/entry_points.txt ADDED
@@ -0,0 +1,2 @@
1
+ [console_scripts]
2
+ key-transform = key_transform.main:cli
key_transform-1.0.1.dist-info/licenses/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2025 Sebastian Wiesinger
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.