paramiko-cloud 1.3.0__tar.gz → 1.3.2__tar.gz

paramiko_cloud-1.3.2/PKG-INFO

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: paramiko-cloud
+Version: 1.3.2
+Summary: Use cloud-managed keys to sign SSH certificates
+Author-email: Jason Rigby <hello@jasonrig.by>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/jasonrig/paramiko-cloud/
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: paramiko
+Requires-Dist: cryptography
+Requires-Dist: protobuf
+Requires-Dist: grpcio-tools
+Provides-Extra: aws
+Requires-Dist: boto3; extra == "aws"
+Provides-Extra: gcp
+Requires-Dist: google-cloud-kms; extra == "gcp"
+Provides-Extra: azure
+Requires-Dist: azure-keyvault-keys; extra == "azure"
+Requires-Dist: azure-identity; extra == "azure"
+Provides-Extra: all
+Requires-Dist: boto3; extra == "all"
+Requires-Dist: google-cloud-kms; extra == "all"
+Requires-Dist: azure-keyvault-keys; extra == "all"
+Requires-Dist: azure-identity; extra == "all"
+
+# Paramiko-Cloud
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=jasonrig_paramiko-cloud&metric=sqale_rating)](https://sonarcloud.io/dashboard?id=jasonrig_paramiko-cloud) [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=jasonrig_paramiko-cloud&metric=security_rating)](https://sonarcloud.io/dashboard?id=jasonrig_paramiko-cloud) [![Technical Debt](https://sonarcloud.io/api/project_badges/measure?project=jasonrig_paramiko-cloud&metric=sqale_index)](https://sonarcloud.io/dashboard?id=jasonrig_paramiko-cloud)
+
+Paramiko-Cloud is an extension to Paramiko that provides ECDSA SSH keys managed by
+cloud-based key management services. As well as enabling Paramiko to perform SSH
+operations using cloud-managed keys, it also provides certificate signing functions,
+simplifying the implementation of an SSH certificate authority.
+
+Paramiko-Cloud supports:
+* [Amazon Web Services - Key Management Service](https://aws.amazon.com/kms/)
+* [Google Cloud Platform - Cloud Key Management Service](https://cloud.google.com/security-key-management)
+* [Microsoft Azure - Key Vault](https://azure.microsoft.com/en-us/services/key-vault/)
+
+Read the docs here: https://paramiko-cloud.readthedocs.io/en/latest/
+
+## Development with uv
+
+```shell
+# Sync runtime + optional cloud provider dependencies + test tooling
+uv sync --extra all --group dev
+
+# Generate protobuf / gRPC Python modules
+uv run python scripts/build_proto.py
+
+# Run tests
+uv run pytest --cov=./ --cov-report=xml
+
+# Static checks (requires generated protobuf modules first)
+uv run python scripts/build_proto.py
+uv run ruff check .
+uv run ruff format . --check
+uv run mypy paramiko_cloud
+```

paramiko_cloud-1.3.2/README.md

@@ -0,0 +1,33 @@
+# Paramiko-Cloud
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=jasonrig_paramiko-cloud&metric=sqale_rating)](https://sonarcloud.io/dashboard?id=jasonrig_paramiko-cloud) [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=jasonrig_paramiko-cloud&metric=security_rating)](https://sonarcloud.io/dashboard?id=jasonrig_paramiko-cloud) [![Technical Debt](https://sonarcloud.io/api/project_badges/measure?project=jasonrig_paramiko-cloud&metric=sqale_index)](https://sonarcloud.io/dashboard?id=jasonrig_paramiko-cloud)
+
+Paramiko-Cloud is an extension to Paramiko that provides ECDSA SSH keys managed by
+cloud-based key management services. As well as enabling Paramiko to perform SSH
+operations using cloud-managed keys, it also provides certificate signing functions,
+simplifying the implementation of an SSH certificate authority.
+
+Paramiko-Cloud supports:
+* [Amazon Web Services - Key Management Service](https://aws.amazon.com/kms/)
+* [Google Cloud Platform - Cloud Key Management Service](https://cloud.google.com/security-key-management)
+* [Microsoft Azure - Key Vault](https://azure.microsoft.com/en-us/services/key-vault/)
+
+Read the docs here: https://paramiko-cloud.readthedocs.io/en/latest/
+
+## Development with uv
+
+```shell
+# Sync runtime + optional cloud provider dependencies + test tooling
+uv sync --extra all --group dev
+
+# Generate protobuf / gRPC Python modules
+uv run python scripts/build_proto.py
+
+# Run tests
+uv run pytest --cov=./ --cov-report=xml
+
+# Static checks (requires generated protobuf modules first)
+uv run python scripts/build_proto.py
+uv run ruff check .
+uv run ruff format . --check
+uv run mypy paramiko_cloud
+```

{paramiko-cloud-1.3.0 → paramiko_cloud-1.3.2}/paramiko_cloud/aws/keys.py

@@ -1,7 +1,11 @@
-from typing import Set
+from typing import Any, Set, cast
 
 import boto3
-from cryptography.hazmat.primitives.asymmetric.ec import ECDSA, EllipticCurve
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    ECDSA,
+    EllipticCurve,
+    EllipticCurvePublicKey,
+)
 from cryptography.hazmat.primitives.serialization import load_der_public_key
 
 from paramiko_cloud.base import BaseKeyECDSA, CloudSigningKey
@@ -12,7 +16,9 @@ class _AWSSigningKey(CloudSigningKey):
     Provides signing operations to Paramiko for the AWS KMS-backed key
     """
 
-    def __init__(self, client, key_id: str, signing_algo: str, curve: EllipticCurve):
+    def __init__(
+        self, client: Any, key_id: str, signing_algo: str, curve: EllipticCurve
+    ) -> None:
         """
         Constructor
 
@@ -46,9 +52,9 @@ class _AWSSigningKey(CloudSigningKey):
             Message=hash_,
             MessageType="DIGEST",
             GrantTokens=[
-                'string',
+                "string",
             ],
-            SigningAlgorithm=self.signing_algo
+            SigningAlgorithm=self.signing_algo,
         )
         return signing_response["Signature"]
 
@@ -71,31 +77,35 @@ class ECDSAKey(BaseKeyECDSA):
         ("ECC_NIST_P521", "ECDSA_SHA_512"),
     )
 
-    def __init__(self, key_id: str, **kwargs):
-        client = boto3.client('kms', **kwargs)
+    def __init__(self, key_id: str, **kwargs: Any) -> None:
+        client = boto3.client("kms", **kwargs)
         pub_key = client.get_public_key(
             KeyId=key_id,
             GrantTokens=[
-                'string',
-            ]
+                "string",
+            ],
         )
 
         assert any(
-            signing_algo in pub_key["SigningAlgorithms"] and
-            key_spec == pub_key["CustomerMasterKeySpec"]
-            for key_spec, signing_algo in self._ALLOWED_ALGOS), \
-            "No supported key/algorithm pair found."
+            signing_algo in pub_key["SigningAlgorithms"]
+            and key_spec == pub_key["CustomerMasterKeySpec"]
+            for key_spec, signing_algo in self._ALLOWED_ALGOS
+        ), "No supported key/algorithm pair found."
         assert pub_key["KeyUsage"] == "SIGN_VERIFY", "Key does not support signing."
 
-        verifying_key = load_der_public_key(pub_key["PublicKey"])
+        verifying_key = cast(
+            EllipticCurvePublicKey, load_der_public_key(pub_key["PublicKey"])
+        )
 
         super().__init__(
             (
                 _AWSSigningKey(
                     client,
                     key_id,
-                    self._choose_signing_algo(set(pub_key["SigningAlgorithms"])), verifying_key.curve),
-                verifying_key
+                    self._choose_signing_algo(set(pub_key["SigningAlgorithms"])),
+                    verifying_key.curve,
+                ),
+                verifying_key,
             )
         )
 
@@ -110,4 +120,6 @@ class ECDSAKey(BaseKeyECDSA):
             The selected signing algorithm
         """
 
-        return set([algo for _, algo in self._ALLOWED_ALGOS]).intersection(supported_algos).pop()
+        return {algo for _, algo in self._ALLOWED_ALGOS}.intersection(
+            supported_algos
+        ).pop()

{paramiko-cloud-1.3.0 → paramiko_cloud-1.3.2}/paramiko_cloud/aws/test_keys.py

@@ -16,7 +16,7 @@ def set_up_mocks(boto3_mock: Mock, curve: EllipticCurve, hash_algo: HashAlgorith
     priv_key = ec.generate_private_key(curve)
     pem_key = priv_key.public_key().public_bytes(
         encoding=serialization.Encoding.DER,
-        format=serialization.PublicFormat.SubjectPublicKeyInfo
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
     )
 
     signing_algorithm_name = "ECDSA_SHA_{}".format(hash_algo.name[-3:])
@@ -27,17 +27,12 @@ def set_up_mocks(boto3_mock: Mock, curve: EllipticCurve, hash_algo: HashAlgorith
         "SigningAlgorithms": [signing_algorithm_name],
         "CustomerMasterKeySpec": key_spec_name,
         "KeyUsage": "SIGN_VERIFY",
-        "PublicKey": pem_key
+        "PublicKey": pem_key,
     }
 
     def sign(KeyId, Message, MessageType, GrantTokens, SigningAlgorithm):
         assert SigningAlgorithm == signing_algorithm_name
-        return {
-            "Signature": priv_key.sign(
-                Message,
-                ec.ECDSA(Prehashed(hash_algo))
-            )
-        }
+        return {"Signature": priv_key.sign(Message, ec.ECDSA(Prehashed(hash_algo)))}
 
     boto3_instance.sign.side_effect = sign
 
@@ -46,44 +41,55 @@ class TestECDSAKey(TestCase):
     ALL_SUPPORTED_ALGOS: Tuple[Tuple[EllipticCurve, HashAlgorithm]] = (
         (ec.SECP256R1(), hashes.SHA256()),
         (ec.SECP384R1(), hashes.SHA384()),
-        (ec.SECP521R1(), hashes.SHA512())
+        (ec.SECP521R1(), hashes.SHA512()),
     )
 
     @patch("boto3.client")
     def test_key_from_cloud_can_sign(self, boto3_mock: Mock):
         from paramiko_cloud.aws.keys import ECDSAKey
+
         for curve, hash_ in self.ALL_SUPPORTED_ALGOS:
-            with self.subTest("Using curve {} and hash {}".format(curve.name, hash_.name)):
+            with self.subTest(
+                "Using curve {} and hash {}".format(curve.name, hash_.name)
+            ):
                 set_up_mocks(boto3_mock, curve, hash_)
                 key = ECDSAKey("test_key", region_name="ap-northeast-1")
                 signature = key.sign_ssh_data(b"hello world")
                 signature.rewind()
-                self.assertTrue(key.verify_ssh_sig(b"hello world", signature), "Signature is invalid")
+                self.assertTrue(
+                    key.verify_ssh_sig(b"hello world", signature),
+                    "Signature is invalid",
+                )
 
     @patch("boto3.client")
     def test_key_from_cloud_can_produce_valid_certificate(self, boto3_mock: Mock):
         from paramiko_cloud.aws.keys import ECDSAKey
+
         for curve, hash_ in self.ALL_SUPPORTED_ALGOS:
-            with self.subTest("Using curve {} and hash {}".format(curve.name, hash_.name)):
+            with self.subTest(
+                "Using curve {} and hash {}".format(curve.name, hash_.name)
+            ):
                 set_up_mocks(boto3_mock, curve, hash_)
                 ca_key = ECDSAKey("test_key", region_name="ap-northeast-1")
                 client_key = RSAKey.generate(1024)
-                cert_string = ca_key.sign_certificate(client_key, ["test.user"]).cert_string()
+                cert_string = ca_key.sign_certificate(
+                    client_key, ["test.user"]
+                ).cert_string()
                 exit_code, cert_details = parse_certificate(cert_string)
                 self.assertEqual(
                     cert_details.public_key,
-                    "RSA-CERT SHA256:{}".format(sha256_fingerprint(client_key))
+                    "RSA-CERT SHA256:{}".format(sha256_fingerprint(client_key)),
                 )
                 self.assertEqual(
                     cert_details.signing_ca,
                     "ECDSA SHA256:{} (using ecdsa-sha2-nistp{})".format(
-                        sha256_fingerprint(ca_key),
-                        ca_key.ecdsa_curve.key_length
-                    )
+                        sha256_fingerprint(ca_key), ca_key.ecdsa_curve.key_length
+                    ),
                 )
                 self.assertEqual(
-                    exit_code, 0,
+                    exit_code,
+                    0,
                     "Could not parse generated certificate with ssh-keygen, exit code {}".format(
                         exit_code
-                    )
+                    ),
                 )

{paramiko-cloud-1.3.0 → paramiko_cloud-1.3.2}/paramiko_cloud/azure/keys.py

@@ -1,12 +1,28 @@
-from typing import Union
-
-from azure.identity import DefaultAzureCredential, AzurePowerShellCredential, InteractiveBrowserCredential, \
-    ChainedTokenCredential, EnvironmentCredential, ManagedIdentityCredential, SharedTokenCacheCredential, \
-    AzureCliCredential, VisualStudioCodeCredential
+from typing import Union, cast
+
+from azure.identity import (
+    DefaultAzureCredential,
+    AzurePowerShellCredential,
+    InteractiveBrowserCredential,
+    ChainedTokenCredential,
+    EnvironmentCredential,
+    ManagedIdentityCredential,
+    SharedTokenCacheCredential,
+    AzureCliCredential,
+    VisualStudioCodeCredential,
+)
 from azure.keyvault.keys import KeyClient
 from azure.keyvault.keys.crypto import CryptographyClient, SignatureAlgorithm
-from cryptography.hazmat.primitives.asymmetric.ec import ECDSA, EllipticCurvePublicNumbers, SECP256R1, \
-    SECP384R1, SECP521R1, SECP224R1, SECP192R1, EllipticCurve
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    ECDSA,
+    EllipticCurvePublicNumbers,
+    SECP256R1,
+    SECP384R1,
+    SECP521R1,
+    SECP224R1,
+    SECP192R1,
+    EllipticCurve,
+)
 from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature
 
 from paramiko_cloud.base import BaseKeyECDSA, CloudSigningKey
@@ -65,8 +81,8 @@ class _AzureSigningKey(CloudSigningKey):
         digest = self.digest(data, signature_algorithm)
         signing_response = self.crypto_client.sign(self._signaure_algorithm(), digest)
         raw_signature = signing_response.signature
-        r = int.from_bytes(raw_signature[:len(raw_signature) // 2], "big")
-        s = int.from_bytes(raw_signature[len(raw_signature) // 2:], "big")
+        r = int.from_bytes(raw_signature[: len(raw_signature) // 2], "big")
+        s = int.from_bytes(raw_signature[len(raw_signature) // 2 :], "big")
         return encode_dss_signature(r, s)
 
 
@@ -83,32 +99,49 @@ class ECDSAKey(BaseKeyECDSA):
        https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate
     """
 
-    _ALLOWED_ALGOS = (
-        "EC",
-    )
-
-    def __init__(self, credential: Union[DefaultAzureCredential, AzurePowerShellCredential,
-    InteractiveBrowserCredential, ChainedTokenCredential, EnvironmentCredential,
-    ManagedIdentityCredential, SharedTokenCacheCredential, AzureCliCredential,
-    VisualStudioCodeCredential],
-                 vault_url: str, key_name: str):
+    _ALLOWED_ALGOS = ("EC",)
+
+    def __init__(
+        self,
+        credential: Union[
+            DefaultAzureCredential,
+            AzurePowerShellCredential,
+            InteractiveBrowserCredential,
+            ChainedTokenCredential,
+            EnvironmentCredential,
+            ManagedIdentityCredential,
+            SharedTokenCacheCredential,
+            AzureCliCredential,
+            VisualStudioCodeCredential,
+        ],
+        vault_url: str,
+        key_name: str,
+    ):
         vault_client = KeyClient(vault_url, credential=credential)
         pub_key = vault_client.get_key(key_name)
-        assert pub_key.key_type in self._ALLOWED_ALGOS, "Unsupported signing algorithm: {}".format(pub_key.key_type)
+        assert pub_key.key_type in self._ALLOWED_ALGOS, (
+            "Unsupported signing algorithm: {}".format(pub_key.key_type)
+        )
+
+        jwk = pub_key.key
+        assert jwk is not None, "Missing key material from Azure Key Vault."
+        curve_name = cast(str, getattr(jwk, "crv"))
 
-        assert pub_key.key.crv in _CURVES, "Unsupported curve: {}".format(pub_key.key.crv)
+        assert curve_name in _CURVES, "Unsupported curve: {}".format(curve_name)
 
-        curve = _CURVES[pub_key.key.crv]()
+        curve = _CURVES[curve_name]()  # type: ignore[abstract]
 
         verifying_key = EllipticCurvePublicNumbers(
-            int.from_bytes(pub_key.key.x, "big"),
-            int.from_bytes(pub_key.key.y, "big"),
-            curve
+            int.from_bytes(cast(bytes, getattr(jwk, "x")), "big"),
+            int.from_bytes(cast(bytes, getattr(jwk, "y")), "big"),
+            curve,
         ).public_key()
 
         super().__init__(
             (
-                _AzureSigningKey(CryptographyClient(pub_key, credential), verifying_key.curve),
-                verifying_key
+                _AzureSigningKey(
+                    CryptographyClient(pub_key, credential), verifying_key.curve
+                ),
+                verifying_key,
             )
         )

{paramiko-cloud-1.3.0 → paramiko_cloud-1.3.2}/paramiko_cloud/azure/test_keys.py

@@ -6,7 +6,10 @@ from azure.keyvault.keys import KeyVaultKey
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurve
-from cryptography.hazmat.primitives.asymmetric.utils import Prehashed, decode_dss_signature
+from cryptography.hazmat.primitives.asymmetric.utils import (
+    Prehashed,
+    decode_dss_signature,
+)
 from cryptography.hazmat.primitives.hashes import HashAlgorithm
 from paramiko.rsakey import RSAKey
 
@@ -18,77 +21,109 @@ class _SigningResponse:
         self.signature = signature
 
 
-def set_up_mocks(key_client_mock: Mock, crypto_client_mock: Mock, curve: EllipticCurve, hash_algo: HashAlgorithm,
-                 key_name: str):
+def set_up_mocks(
+    key_client_mock: Mock,
+    crypto_client_mock: Mock,
+    curve: EllipticCurve,
+    hash_algo: HashAlgorithm,
+    key_name: str,
+):
     priv_key = ec.generate_private_key(curve)
     pub_key = priv_key.public_key().public_numbers()
 
     crypto_client_instance = crypto_client_mock.return_value
 
     def sign(_, digest):
-        signature = priv_key.sign(
-            digest,
-            ec.ECDSA(Prehashed(hash_algo))
-        )
+        signature = priv_key.sign(digest, ec.ECDSA(Prehashed(hash_algo)))
         r, s = decode_dss_signature(signature)
         return _SigningResponse(r.to_bytes(128, "big") + s.to_bytes(128, "big"))
 
     crypto_client_instance.sign.side_effect = sign
     key_client_instance = key_client_mock.return_value
-    key_client_instance.get_key.return_value = KeyVaultKey(key_name, jwk={
-        "kty": "EC",
-        "crv": "P-{}".format(curve.key_size),
-        "x": int.to_bytes(pub_key.x, 128, "big"),
-        "y": int.to_bytes(pub_key.y, 128, "big")
-    })
+    key_client_instance.get_key.return_value = KeyVaultKey(
+        key_name,
+        jwk={
+            "kty": "EC",
+            "crv": "P-{}".format(curve.key_size),
+            "x": int.to_bytes(pub_key.x, 128, "big"),
+            "y": int.to_bytes(pub_key.y, 128, "big"),
+        },
+    )
 
 
 class TestECDSAKey(TestCase):
     ALL_SUPPORTED_ALGOS: Tuple[Tuple[EllipticCurve, HashAlgorithm]] = (
         (ec.SECP256R1(), hashes.SHA256()),
         (ec.SECP384R1(), hashes.SHA384()),
-        (ec.SECP521R1(), hashes.SHA512())
+        (ec.SECP521R1(), hashes.SHA512()),
     )
 
     TEST_KEY_NAME = "https://test-vault.vault.azure.net/keys/abc/1"
 
     @patch("azure.keyvault.keys.crypto.CryptographyClient")
     @patch("azure.keyvault.keys.KeyClient")
-    def test_key_from_cloud_can_sign(self, key_client_mock: Mock, crypto_client_mock: Mock):
+    def test_key_from_cloud_can_sign(
+        self, key_client_mock: Mock, crypto_client_mock: Mock
+    ):
         from paramiko_cloud.azure.keys import ECDSAKey
+
         for curve, hash_ in self.ALL_SUPPORTED_ALGOS:
-            with self.subTest("Using curve {} and hash {}".format(curve.name, hash_.name)):
-                set_up_mocks(key_client_mock, crypto_client_mock, curve, hash_, self.TEST_KEY_NAME)
+            with self.subTest(
+                "Using curve {} and hash {}".format(curve.name, hash_.name)
+            ):
+                set_up_mocks(
+                    key_client_mock,
+                    crypto_client_mock,
+                    curve,
+                    hash_,
+                    self.TEST_KEY_NAME,
+                )
                 key = ECDSAKey(None, None, "test_key")
                 signature = key.sign_ssh_data(b"hello world")
                 signature.rewind()
-                self.assertTrue(key.verify_ssh_sig(b"hello world", signature), "Signature is invalid")
+                self.assertTrue(
+                    key.verify_ssh_sig(b"hello world", signature),
+                    "Signature is invalid",
+                )
 
     @patch("azure.keyvault.keys.crypto.CryptographyClient")
     @patch("azure.keyvault.keys.KeyClient")
-    def test_key_from_cloud_can_produce_valid_certificate(self, key_client_mock: Mock, crypto_client_mock: Mock):
+    def test_key_from_cloud_can_produce_valid_certificate(
+        self, key_client_mock: Mock, crypto_client_mock: Mock
+    ):
         from paramiko_cloud.azure.keys import ECDSAKey
+
         for curve, hash_ in self.ALL_SUPPORTED_ALGOS:
-            with self.subTest("Using curve {} and hash {}".format(curve.name, hash_.name)):
-                set_up_mocks(key_client_mock, crypto_client_mock, curve, hash_, self.TEST_KEY_NAME)
+            with self.subTest(
+                "Using curve {} and hash {}".format(curve.name, hash_.name)
+            ):
+                set_up_mocks(
+                    key_client_mock,
+                    crypto_client_mock,
+                    curve,
+                    hash_,
+                    self.TEST_KEY_NAME,
+                )
                 ca_key = ECDSAKey(None, None, "test_key")
                 client_key = RSAKey.generate(1024)
-                cert_string = ca_key.sign_certificate(client_key, ["test.user"]).cert_string()
+                cert_string = ca_key.sign_certificate(
+                    client_key, ["test.user"]
+                ).cert_string()
                 exit_code, cert_details = parse_certificate(cert_string)
                 self.assertEqual(
                     cert_details.public_key,
-                    "RSA-CERT SHA256:{}".format(sha256_fingerprint(client_key))
+                    "RSA-CERT SHA256:{}".format(sha256_fingerprint(client_key)),
                 )
                 self.assertEqual(
                     cert_details.signing_ca,
                     "ECDSA SHA256:{} (using ecdsa-sha2-nistp{})".format(
-                        sha256_fingerprint(ca_key),
-                        ca_key.ecdsa_curve.key_length
-                    )
+                        sha256_fingerprint(ca_key), ca_key.ecdsa_curve.key_length
+                    ),
                 )
                 self.assertEqual(
-                    exit_code, 0,
+                    exit_code,
+                    0,
                     "Could not parse generated certificate with ssh-keygen, exit code {}".format(
                         exit_code
-                    )
+                    ),
                 )

{paramiko-cloud-1.3.0 → paramiko_cloud-1.3.2}/paramiko_cloud/base.py

@@ -2,9 +2,14 @@ import abc
 import base64
 import hashlib
 from datetime import datetime
-from typing import Tuple, Optional, IO, Callable, Any
-
-from cryptography.hazmat.primitives.asymmetric.ec import ECDSA, EllipticCurvePublicKey, EllipticCurve
+from typing import Any, Callable, IO, Optional, Tuple
+
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    ECDSA,
+    EllipticCurvePublicKey,
+    EllipticCurve,
+)
+from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
 from paramiko import ECDSAKey, Message
 
 from paramiko_cloud.pki import CertificateSigningKeyMixin
@@ -37,7 +42,10 @@ class CloudSigningKey(abc.ABC):
         Returns:
             The hash of the data
         """
-        return getattr(hashlib, signature_algorithm.algorithm.name)(data).digest()
+        algorithm = signature_algorithm.algorithm
+        if isinstance(algorithm, Prehashed):
+            algorithm = algorithm._algorithm
+        return getattr(hashlib, algorithm.name)(data).digest()
 
     def sign(self, data: bytes, signature_algorithm: ECDSA) -> bytes:
         """
@@ -68,20 +76,28 @@ class BaseKeyECDSA(ECDSAKey, CertificateSigningKeyMixin):
         """
         super().__init__(vals=vals)
 
-    def write_private_key_file(self, filename: str, password: Optional[str] = ...):
+    def write_private_key_file(
+        self, filename: str, password: Optional[str] = None
+    ) -> None:
         raise RuntimeError("Private key managed externally, cannot export")
 
-    def write_private_key(self, file_obj: IO[str], password: Optional[str] = ...):
+    def write_private_key(
+        self, file_obj: IO[str], password: Optional[str] = None
+    ) -> None:
         raise RuntimeError("Private key managed externally, cannot export")
 
     @classmethod
     def generate(
-            cls, curve: EllipticCurve = ..., progress_func: Optional[Callable[..., Any]] = ...,
-            bits: Optional[int] = ...
-    ):
-        raise RuntimeError("Create new signing keys using the KMS client for your cloud provider")
+        cls,
+        curve: Optional[EllipticCurve] = None,
+        progress_func: Optional[Callable[..., Any]] = None,
+        bits: Optional[int] = None,
+    ) -> "BaseKeyECDSA":
+        raise RuntimeError(
+            "Create new signing keys using the KMS client for your cloud provider"
+        )
 
-    def pubkey_string(self, comment=None) -> str:
+    def pubkey_string(self, comment: Optional[str] = None) -> str:
         """
         Render a string suitable for OpenSSH authorized_keys files
 
@@ -97,5 +113,5 @@ class BaseKeyECDSA(ECDSAKey, CertificateSigningKeyMixin):
         return "{key_type} {pubkey_string} {comment}".format(
             key_type=key_type,
             pubkey_string=base64.standard_b64encode(key_bytes).decode(),
-            comment=comment or datetime.now().isoformat()
+            comment=comment or datetime.now().isoformat(),
         )

{paramiko-cloud-1.3.0 → paramiko_cloud-1.3.2}/paramiko_cloud/dummy/keys.py

@@ -1,4 +1,4 @@
-from typing import Optional
+from typing import Optional, cast
 
 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey, ECDSA
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
@@ -10,6 +10,7 @@ class _LocalSigningKey(CloudSigningKey):
     """
     A dummy signing key
     """
+
     def __init__(self, key: EllipticCurvePrivateKey):
         super().__init__(key.curve)
         self.key = key
@@ -26,7 +27,10 @@ class ECDSAKey(BaseKeyECDSA):
         pem_private_key: A PEM-formatted private key
         password: An optional password to decrypt the private key
     """
+
     def __init__(self, pem_private_key: bytes, password: Optional[bytes] = None):
-        private_key: EllipticCurvePrivateKey = load_pem_private_key(pem_private_key, password)
+        private_key = cast(
+            EllipticCurvePrivateKey, load_pem_private_key(pem_private_key, password)
+        )
         public_key = private_key.public_key()
         super().__init__((_LocalSigningKey(private_key), public_key))