chore: add warning for rsa library

google/auth/crypt/_python_rsa.py

@@ -22,6 +22,7 @@
 from __future__ import absolute_import
 
 import io
+import warnings
 
 from pyasn1.codec.der import decoder  # type: ignore
 from pyasn1_modules import pem  # type: ignore
@@ -39,6 +40,16 @@
 _PKCS8_MARKER = ("-----BEGIN PRIVATE KEY-----", "-----END PRIVATE KEY-----")
 _PKCS8_SPEC = PrivateKeyInfo()
 
+warnings.warn(
+    (
+        "The 'rsa' library is deprecated and will be removed in a future release. "
+        "Please migrate to 'cryptography'. To keep using the legacy library, "
+        "install 'google-auth[rsa]'."
+    ),
+    category=FutureWarning,
+    stacklevel=2,
+)
+
 
 def _bit_list_to_bytes(bit_list):
     """Converts an iterable of 1s and 0s to bytes.

noxfile.py

@@ -129,6 +129,7 @@ def unit(session):
         "--cov-report=term-missing",
         "tests",
         "tests_async",
+        *session.posargs,
     )
 
 

setup.py

@@ -46,6 +46,8 @@
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1739): Add bounds for urllib3 and packaging dependencies.
 urllib3_extra_require = ["urllib3", "packaging"]
 
+rsa_extra_require = ["rsa>=3.1.4,<5"]
+
 # Unit test requirements.
 testing_extra_require = [
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1735): Remove `grpcio` from testing requirements once an extra is added for `grpcio` dependency.
@@ -85,6 +87,7 @@
     "requests": requests_extra_require,
     "testing": testing_extra_require,
     "urllib3": urllib3_extra_require,
+    "rsa": rsa_extra_require,
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1735): Add an extra for `grpcio` dependency.
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1736): Add an extra for `oauth2client` dependency.
 }

tests/crypt/test__python_rsa.py

@@ -191,3 +191,12 @@ def test_from_service_account_file(self):
 
         assert signer.key_id == SERVICE_ACCOUNT_INFO[base._JSON_FILE_PRIVATE_KEY_ID]
         assert isinstance(signer._key, rsa.key.PrivateKey)
+
+
+class TestModule(object):
+    def test_import_warning(self):
+        import importlib
+        from google.auth.crypt import _python_rsa
+
+        with pytest.warns(FutureWarning, match="The 'rsa' library is deprecated"):
+            importlib.reload(_python_rsa)