paramiko-cloud 1.3.1__tar.gz → 2.0.0__tar.gz

{paramiko_cloud-1.3.1 → paramiko_cloud-2.0.0}/PKG-INFO

@@ -1,14 +1,14 @@
 Metadata-Version: 2.4
 Name: paramiko-cloud
-Version: 1.3.1
+Version: 2.0.0
 Summary: Use cloud-managed keys to sign SSH certificates
 Author-email: Jason Rigby <hello@jasonrig.by>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/jasonrig/paramiko-cloud/
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: paramiko
-Requires-Dist: cryptography
+Requires-Dist: paramiko>=5.0.0
+Requires-Dist: cryptography>=45.0.1
 Requires-Dist: protobuf
 Requires-Dist: grpcio-tools
 Provides-Extra: aws
@@ -55,5 +55,5 @@ uv run pytest --cov=./ --cov-report=xml
 uv run python scripts/build_proto.py
 uv run ruff check .
 uv run ruff format . --check
-uv run mypy paramiko_cloud
+uv run mypy paramiko_cloud tests
 ```

{paramiko_cloud-1.3.1 → paramiko_cloud-2.0.0}/README.md

@@ -29,5 +29,5 @@ uv run pytest --cov=./ --cov-report=xml
 uv run python scripts/build_proto.py
 uv run ruff check .
 uv run ruff format . --check
-uv run mypy paramiko_cloud
+uv run mypy paramiko_cloud tests
 ```

{paramiko_cloud-1.3.1 → paramiko_cloud-2.0.0}/paramiko_cloud/aws/keys.py

@@ -1,12 +1,12 @@
-from typing import Any, Set, cast
+from typing import Any
 
 import boto3
 from cryptography.hazmat.primitives.asymmetric.ec import (
-    ECDSA,
-    EllipticCurve,
     EllipticCurvePublicKey,
+    EllipticCurveSignatureAlgorithm,
 )
 from cryptography.hazmat.primitives.serialization import load_der_public_key
+from cryptography.utils import Buffer
 
 from paramiko_cloud.base import BaseKeyECDSA, CloudSigningKey
 
@@ -17,7 +17,11 @@ class _AWSSigningKey(CloudSigningKey):
     """
 
     def __init__(
-        self, client: Any, key_id: str, signing_algo: str, curve: EllipticCurve
+        self,
+        client: Any,
+        key_id: str,
+        signing_algo: str,
+        public_key: EllipticCurvePublicKey,
     ) -> None:
         """
         Constructor
@@ -26,15 +30,19 @@ class _AWSSigningKey(CloudSigningKey):
             client: the AWS KMS client from boto3
             key_id: the AWS KMS key id
             signing_algo: the signing algorithm to use
-            curve: the elliptic curve used for this key
+            public_key: the public key corresponding to the KMS key
         """
 
-        super().__init__(curve)
+        super().__init__(public_key)
         self.client = client
         self.key_id = key_id
         self.signing_algo = signing_algo
 
-    def sign(self, data: bytes, signature_algorithm: ECDSA) -> bytes:
+    def sign(
+        self,
+        data: Buffer,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
         """
         Calculate the signature for the given data
 
@@ -93,9 +101,9 @@ class ECDSAKey(BaseKeyECDSA):
         ), "No supported key/algorithm pair found."
         assert pub_key["KeyUsage"] == "SIGN_VERIFY", "Key does not support signing."
 
-        verifying_key = cast(
-            EllipticCurvePublicKey, load_der_public_key(pub_key["PublicKey"])
-        )
+        verifying_key = load_der_public_key(pub_key["PublicKey"])
+        if not isinstance(verifying_key, EllipticCurvePublicKey):
+            raise TypeError("AWS KMS public key is not an elliptic curve key")
 
         super().__init__(
             (
@@ -103,13 +111,13 @@ class ECDSAKey(BaseKeyECDSA):
                     client,
                     key_id,
                     self._choose_signing_algo(set(pub_key["SigningAlgorithms"])),
-                    verifying_key.curve,
+                    verifying_key,
                 ),
                 verifying_key,
             )
         )
 
-    def _choose_signing_algo(self, supported_algos: Set[str]) -> str:
+    def _choose_signing_algo(self, supported_algos: set[str]) -> str:
         """
         Selects the appropriate signing algorithm based on the supported and offered signing algorithms
 

{paramiko_cloud-1.3.1 → paramiko_cloud-2.0.0}/paramiko_cloud/azure/keys.py

@@ -1,33 +1,36 @@
-from typing import Union, cast
+from collections.abc import Callable
+from typing import Protocol, runtime_checkable
 
 from azure.identity import (
-    DefaultAzureCredential,
+    AzureCliCredential,
     AzurePowerShellCredential,
-    InteractiveBrowserCredential,
     ChainedTokenCredential,
+    DefaultAzureCredential,
     EnvironmentCredential,
+    InteractiveBrowserCredential,
     ManagedIdentityCredential,
     SharedTokenCacheCredential,
-    AzureCliCredential,
     VisualStudioCodeCredential,
 )
 from azure.keyvault.keys import KeyClient
 from azure.keyvault.keys.crypto import CryptographyClient, SignatureAlgorithm
 from cryptography.hazmat.primitives.asymmetric.ec import (
-    ECDSA,
-    EllipticCurvePublicNumbers,
+    SECP192R1,
+    SECP224R1,
     SECP256R1,
     SECP384R1,
     SECP521R1,
-    SECP224R1,
-    SECP192R1,
     EllipticCurve,
+    EllipticCurvePublicKey,
+    EllipticCurvePublicNumbers,
+    EllipticCurveSignatureAlgorithm,
 )
 from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature
+from cryptography.utils import Buffer
 
 from paramiko_cloud.base import BaseKeyECDSA, CloudSigningKey
 
-_CURVES = {
+_CURVES: dict[str, Callable[[], EllipticCurve]] = {
     "P-256": SECP256R1,
     "P-384": SECP384R1,
     "P-521": SECP521R1,
@@ -36,17 +39,30 @@ _CURVES = {
 }
 
 
+@runtime_checkable
+class _ECJsonWebKey(Protocol):
+    """Elliptic-curve fields dynamically provided by Azure's JsonWebKey."""
+
+    crv: str
+    x: bytes
+    y: bytes
+
+
 class _AzureSigningKey(CloudSigningKey):
     """
     Provides signing operations to Paramiko for the Azure Key Vault-backed key
 
     Args:
         crypto_client: the Key Vault Cryptography Client authenticated to access the selected key
-        curve: the elliptic curve used for this key
+        public_key: the public key corresponding to the Key Vault key
     """
 
-    def __init__(self, crypto_client: CryptographyClient, curve: EllipticCurve):
-        super().__init__(curve)
+    def __init__(
+        self,
+        crypto_client: CryptographyClient,
+        public_key: EllipticCurvePublicKey,
+    ):
+        super().__init__(public_key)
         self.crypto_client = crypto_client
 
     def _signaure_algorithm(self) -> SignatureAlgorithm:
@@ -66,7 +82,11 @@ class _AzureSigningKey(CloudSigningKey):
         else:
             raise NotImplementedError("Unsupported EC signature algorithm")
 
-    def sign(self, data: bytes, signature_algorithm: ECDSA) -> bytes:
+    def sign(
+        self,
+        data: Buffer,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
         """
         Calculate the signature for the given data
 
@@ -103,44 +123,48 @@ class ECDSAKey(BaseKeyECDSA):
 
     def __init__(
         self,
-        credential: Union[
-            DefaultAzureCredential,
-            AzurePowerShellCredential,
-            InteractiveBrowserCredential,
-            ChainedTokenCredential,
-            EnvironmentCredential,
-            ManagedIdentityCredential,
-            SharedTokenCacheCredential,
-            AzureCliCredential,
-            VisualStudioCodeCredential,
-        ],
+        credential: DefaultAzureCredential
+        | AzurePowerShellCredential
+        | InteractiveBrowserCredential
+        | ChainedTokenCredential
+        | EnvironmentCredential
+        | ManagedIdentityCredential
+        | SharedTokenCacheCredential
+        | AzureCliCredential
+        | VisualStudioCodeCredential,
         vault_url: str,
         key_name: str,
     ):
         vault_client = KeyClient(vault_url, credential=credential)
         pub_key = vault_client.get_key(key_name)
         assert pub_key.key_type in self._ALLOWED_ALGOS, (
-            "Unsupported signing algorithm: {}".format(pub_key.key_type)
+            f"Unsupported signing algorithm: {pub_key.key_type}"
         )
 
         jwk = pub_key.key
         assert jwk is not None, "Missing key material from Azure Key Vault."
-        curve_name = cast(str, getattr(jwk, "crv"))
+        if not isinstance(jwk, _ECJsonWebKey):
+            raise TypeError("Azure Key Vault returned incomplete EC key material")
+        if not isinstance(jwk.crv, str):
+            raise TypeError("Azure Key Vault returned an invalid EC curve name")
+        if not isinstance(jwk.x, bytes) or not isinstance(jwk.y, bytes):
+            raise TypeError("Azure Key Vault returned invalid EC coordinates")
+        curve_name = jwk.crv
 
-        assert curve_name in _CURVES, "Unsupported curve: {}".format(curve_name)
+        assert curve_name in _CURVES, f"Unsupported curve: {curve_name}"
 
-        curve = _CURVES[curve_name]()  # type: ignore[abstract]
+        curve = _CURVES[curve_name]()
 
         verifying_key = EllipticCurvePublicNumbers(
-            int.from_bytes(cast(bytes, getattr(jwk, "x")), "big"),
-            int.from_bytes(cast(bytes, getattr(jwk, "y")), "big"),
+            int.from_bytes(jwk.x, "big"),
+            int.from_bytes(jwk.y, "big"),
             curve,
         ).public_key()
 
         super().__init__(
             (
                 _AzureSigningKey(
-                    CryptographyClient(pub_key, credential), verifying_key.curve
+                    CryptographyClient(pub_key, credential), verifying_key
                 ),
                 verifying_key,
             )

paramiko_cloud-2.0.0/paramiko_cloud/base.py

@@ -0,0 +1,179 @@
+import base64
+import hashlib
+import os
+from abc import abstractmethod
+from collections.abc import Callable
+from datetime import datetime, timezone
+from typing import Any, Protocol
+
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    ECDH,
+    ECDSA,
+    EllipticCurve,
+    EllipticCurvePrivateKey,
+    EllipticCurvePrivateNumbers,
+    EllipticCurvePublicKey,
+    EllipticCurveSignatureAlgorithm,
+)
+from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
+from cryptography.hazmat.primitives.serialization import (
+    Encoding,
+    KeySerializationEncryption,
+    PrivateFormat,
+)
+from cryptography.utils import Buffer
+from paramiko import ECDSAKey, Message
+from paramiko.pkey import PEM, FileFormat
+
+from paramiko_cloud.pki import CertificateSigningKeyMixin
+
+
+class _SupportsWrite(Protocol):
+    def write(self, data: str) -> object: ...
+
+
+class CloudSigningKey(EllipticCurvePrivateKey):
+    """
+    Base class for all cloud KMS-backed signing keys
+    """
+
+    def __init__(self, public_key: EllipticCurvePublicKey):
+        """
+        Constructor
+
+        Args:
+            public_key: the public key corresponding to the cloud-managed key
+        """
+
+        self._public_key = public_key
+
+    @property
+    def curve(self) -> EllipticCurve:
+        return self._public_key.curve
+
+    @property
+    def key_size(self) -> int:
+        return self.curve.key_size
+
+    def public_key(self) -> EllipticCurvePublicKey:
+        return self._public_key
+
+    def __copy__(self) -> "CloudSigningKey":
+        return self
+
+    def __deepcopy__(self, memo: dict[object, object]) -> "CloudSigningKey":
+        return self
+
+    def exchange(
+        self, algorithm: ECDH, peer_public_key: EllipticCurvePublicKey
+    ) -> bytes:
+        raise RuntimeError("Key exchange is unavailable for cloud-managed keys")
+
+    def private_numbers(self) -> EllipticCurvePrivateNumbers:
+        raise RuntimeError("Private key material is managed externally")
+
+    def private_bytes(
+        self,
+        encoding: Encoding,
+        format: PrivateFormat,
+        encryption_algorithm: KeySerializationEncryption,
+    ) -> bytes:
+        raise RuntimeError("Private key material is managed externally")
+
+    @staticmethod
+    def digest(
+        data: Buffer,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
+        """
+        Calculates the hash of the given data according to the given elliptic curve key
+
+        Args:
+            data: the data for which to calculate the hash
+            signature_algorithm: the elliptic curve signature algorithm
+
+        Returns:
+            The hash of the data
+        """
+        if not isinstance(signature_algorithm, ECDSA):
+            raise TypeError("Cloud-managed keys require an ECDSA signature algorithm")
+        algorithm = signature_algorithm.algorithm
+        if isinstance(algorithm, Prehashed):
+            algorithm = algorithm._algorithm
+        return getattr(hashlib, algorithm.name)(data).digest()
+
+    @abstractmethod
+    def sign(
+        self,
+        data: Buffer,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
+        """
+        Calculate the signature for the given data
+
+        Args:
+            data: data for which to calculate a signature
+            signature_algorithm: the curve used for this signature
+
+        Returns:
+            The DER formatted signature
+        """
+
+        raise NotImplementedError()
+
+
+class BaseKeyECDSA(ECDSAKey, CertificateSigningKeyMixin):
+    """
+    Base class for all cloud-backed ECDSA keys
+    """
+
+    def __init__(self, vals: tuple[CloudSigningKey, EllipticCurvePublicKey]):
+        """
+        Constructor
+
+        Args:
+            vals: tuple of signing key and verifying key
+        """
+        super().__init__(vals=vals)
+
+    def write_private_key_file(
+        self,
+        filename: str | bytes | os.PathLike[str] | os.PathLike[bytes],
+        password: str | None = None,
+        file_format: FileFormat = PEM,
+    ) -> None:
+        raise RuntimeError("Private key managed externally, cannot export")
+
+    def write_private_key(
+        self,
+        file_obj: _SupportsWrite,
+        password: str | None = None,
+        file_format: FileFormat = PEM,
+    ) -> None:
+        raise RuntimeError("Private key managed externally, cannot export")
+
+    @classmethod
+    def generate(
+        cls,
+        curve: EllipticCurve | None = None,
+        progress_func: Callable[..., Any] | None = None,
+        bits: int | None = None,
+    ) -> "BaseKeyECDSA":
+        raise RuntimeError(
+            "Create new signing keys using the KMS client for your cloud provider"
+        )
+
+    def pubkey_string(self, comment: str | None = None) -> str:
+        """
+        Render a string suitable for OpenSSH authorized_keys files
+
+        Args:
+            comment: an optional comment, defaulting to the current date and time in ISO format
+
+        Returns:
+            The public key string
+        """
+        key_bytes = self.asbytes()
+        m = Message(self.asbytes())
+        key_type = m.get_text()
+        return f"{key_type} {base64.standard_b64encode(key_bytes).decode()} {comment or datetime.now(timezone.utc).isoformat()}"

paramiko_cloud-2.0.0/paramiko_cloud/dummy/keys.py

@@ -0,0 +1,47 @@
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    EllipticCurvePrivateKey,
+    EllipticCurvePublicKey,
+    EllipticCurveSignatureAlgorithm,
+)
+from cryptography.hazmat.primitives.serialization import load_pem_private_key
+from cryptography.utils import Buffer
+
+from paramiko_cloud.base import BaseKeyECDSA, CloudSigningKey
+
+
+class _LocalSigningKey(CloudSigningKey):
+    """
+    A dummy signing key
+    """
+
+    def __init__(
+        self,
+        key: EllipticCurvePrivateKey,
+        public_key: EllipticCurvePublicKey,
+    ):
+        super().__init__(public_key)
+        self.key = key
+
+    def sign(
+        self,
+        data: Buffer,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
+        return self.key.sign(data, signature_algorithm)
+
+
+class ECDSAKey(BaseKeyECDSA):
+    """
+    A dummy key that demonstrates the abstraction, but just loads they key from file.
+
+    Args:
+        pem_private_key: A PEM-formatted private key
+        password: An optional password to decrypt the private key
+    """
+
+    def __init__(self, pem_private_key: bytes, password: bytes | None = None):
+        private_key = load_pem_private_key(pem_private_key, password)
+        if not isinstance(private_key, EllipticCurvePrivateKey):
+            raise TypeError("PEM private key is not an elliptic curve key")
+        public_key = private_key.public_key()
+        super().__init__((_LocalSigningKey(private_key, public_key), public_key))

{paramiko_cloud-1.3.1 → paramiko_cloud-2.0.0}/paramiko_cloud/gcp/keys.py

@@ -1,10 +1,12 @@
-from typing import cast
-
-from cryptography.hazmat.primitives.asymmetric.ec import ECDSA, EllipticCurve
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    ECDSA,
+    EllipticCurvePublicKey,
+    EllipticCurveSignatureAlgorithm,
+)
 from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
 from cryptography.hazmat.primitives.hashes import HashAlgorithm
-from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
 from cryptography.hazmat.primitives.serialization import load_pem_public_key
+from cryptography.utils import Buffer
 from google.cloud import kms
 from google.cloud.kms_v1 import Digest
 
@@ -17,20 +19,24 @@ class _GCPSigningKey(CloudSigningKey):
     Args:
         kms_client: a KMS client that can access the selected key
         key_name: the name of the key
-        curve: the elliptic curve used for this key
+        public_key: the public key corresponding to the KMS key
     """
 
     def __init__(
         self,
         kms_client: kms.KeyManagementServiceClient,
         key_name: str,
-        curve: EllipticCurve,
+        public_key: EllipticCurvePublicKey,
     ):
-        super().__init__(curve)
+        super().__init__(public_key)
         self.client = kms_client
         self.key_name = key_name
 
-    def sign(self, data: bytes, signature_algorithm: ECDSA) -> bytes:
+    def sign(
+        self,
+        data: Buffer,
+        signature_algorithm: EllipticCurveSignatureAlgorithm,
+    ) -> bytes:
         """
         Calculate the signature for the given data
 
@@ -41,6 +47,8 @@ class _GCPSigningKey(CloudSigningKey):
         Returns:
             The DER formatted signature
         """
+        if not isinstance(signature_algorithm, ECDSA):
+            raise TypeError("GCP KMS keys require an ECDSA signature algorithm")
         if isinstance(signature_algorithm.algorithm, Prehashed):
             algorithm: HashAlgorithm = signature_algorithm.algorithm._algorithm
         else:
@@ -74,14 +82,14 @@ class ECDSAKey(BaseKeyECDSA):
     def __init__(self, kms_client: kms.KeyManagementServiceClient, key_name: str):
         pub_key = kms_client.get_public_key(name=key_name)
         assert pub_key.algorithm.name in self._ALLOWED_ALGOS, (
-            "Unsupported signing algorithm: {}".format(pub_key.algorithm.name)
-        )
-        verifying_key = cast(
-            EllipticCurvePublicKey, load_pem_public_key(pub_key.pem.encode())
+            f"Unsupported signing algorithm: {pub_key.algorithm.name}"
         )
+        verifying_key = load_pem_public_key(pub_key.pem.encode())
+        if not isinstance(verifying_key, EllipticCurvePublicKey):
+            raise TypeError("GCP KMS public key is not an elliptic curve key")
         super().__init__(
             (
-                _GCPSigningKey(kms_client, pub_key.name, verifying_key.curve),
+                _GCPSigningKey(kms_client, pub_key.name, verifying_key),
                 verifying_key,
             )
         )

{paramiko_cloud-1.3.1 → paramiko_cloud-2.0.0}/paramiko_cloud/grpc_server.py

@@ -1,6 +1,5 @@
 from concurrent import futures
 from types import TracebackType
-from typing import Optional, Type
 
 import grpc
 
@@ -25,14 +24,14 @@ class GRPCServer:
         signer_servicer: SignerServicer,
         bind_addr: str = "[::]",
         port: int = 50051,
-        server_credentials: Optional[grpc.ServerCredentials] = None,
+        server_credentials: grpc.ServerCredentials | None = None,
         max_workers: int = 10,
-        shutdown_grace: Optional[int] = None,
+        shutdown_grace: int | None = None,
     ):
         self.shutdown_grace = shutdown_grace
         self.server = grpc.server(futures.ThreadPoolExecutor(max_workers=max_workers))
         rpc_pb2_grpc.add_SignerServicer_to_server(signer_servicer, self.server)
-        address = "{}:{}".format(bind_addr, port)
+        address = f"{bind_addr}:{port}"
         if server_credentials:
             self.server.add_secure_port(address, server_credentials)
         else:
@@ -44,8 +43,8 @@ class GRPCServer:
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_val: Optional[BaseException],
-        exc_tb: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_val: BaseException | None,
+        exc_tb: TracebackType | None,
     ) -> None:
         self.server.stop(self.shutdown_grace)