Refactor: Remove rsa and make cryptography a core dependency

docs/conf.py

@@ -358,6 +358,47 @@
 # texinfo_no_detailmenu = False
 
 
+# -- Options for autodoc --------------------------------------------------
+
+
+def autodoc_skip_member_handler(app, what, name, obj, skip, options):
+    """
+    Skips members from internal modules (like _cryptography_rsa or base)
+    if they are publicly exposed via a higher-level package (like google.auth.crypt),
+    to avoid duplicate documentation entries and ambiguous cross-references.
+    """
+    # Handle RSASigner and RSAVerifier from _cryptography_rsa
+    if name in ("RSASigner", "RSAVerifier") and hasattr(obj, "__module__"):
+        if obj.__module__ == "google.auth.crypt._cryptography_rsa":
+            # Check if it's also available via the public google.auth.crypt path
+            try:
+                import google.auth.crypt
+
+                public_obj = getattr(google.auth.crypt, name, None)
+                if public_obj is obj:
+                    return True  # Skip this internal one
+            except ImportError:
+                pass  # Should not happen if the library is installed
+
+    # Handle Signer and Verifier from base
+    elif name in ("Signer", "Verifier") and hasattr(obj, "__module__"):
+        if obj.__module__ == "google.auth.crypt.base":
+            # Check if it's also available via the public google.auth.crypt path
+            try:
+                import google.auth.crypt
+
+                public_obj = getattr(google.auth.crypt, name, None)
+                if public_obj is obj:
+                    return True  # Skip this internal one
+            except ImportError:
+                pass  # Should not happen if the library is installed
+    return None  # Default behavior (don't skip)
+
+
+def setup(app):
+    app.connect("autodoc-skip-member", autodoc_skip_member_handler)
+
+
 # Example configuration for intersphinx: refer to the Python standard library.
 intersphinx_mapping = {
     "python": ("https://docs.python.org/3.5", None),

google/auth/crypt/rsa.py

@@ -14,17 +14,7 @@
 
 """RSA cryptography signer and verifier."""
 
+from google.auth.crypt import _cryptography_rsa
 
-try:
-    # Prefer cryptograph-based RSA implementation.
-    from google.auth.crypt import _cryptography_rsa
-
-    RSASigner = _cryptography_rsa.RSASigner
-    RSAVerifier = _cryptography_rsa.RSAVerifier
-except ImportError:  # pragma: NO COVER
-    # Fallback to pure-python RSA implementation if cryptography is
-    # unavailable.
-    from google.auth.crypt import _python_rsa
-
-    RSASigner = _python_rsa.RSASigner  # type: ignore
-    RSAVerifier = _python_rsa.RSAVerifier  # type: ignore
+RSASigner = _cryptography_rsa.RSASigner
+RSAVerifier = _cryptography_rsa.RSAVerifier

setup.py

@@ -24,28 +24,22 @@
     "pyasn1-modules>=0.2.1",
     # rsa==4.5 is the last version to support 2.7
     # https://github.com/sybrenstuvel/python-rsa/issues/152#issuecomment-643470233
-    "rsa>=3.1.4,<5",
-)
-
-# TODO(https://github.com/googleapis/google-auth-library-python/issues/1737): Unit test fails with
-#  `No module named 'cryptography.hazmat.backends.openssl.x509' for Python 3.7``.
-cryptography_base_require = [
     "cryptography >= 38.0.3",
     "cryptography < 39.0.0; python_version < '3.8'",
-]
+)
 
 requests_extra_require = ["requests >= 2.20.0, < 3.0.0"]
 
 aiohttp_extra_require = ["aiohttp >= 3.6.2, < 4.0.0", *requests_extra_require]
 
-pyjwt_extra_require = ["pyjwt>=2.0", *cryptography_base_require]
+pyjwt_extra_require = ["pyjwt>=2.0"]
 
 reauth_extra_require = ["pyu2f>=0.1.5"]
 
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1738): Add bounds for cryptography and pyopenssl dependencies.
-enterprise_cert_extra_require = ["cryptography", "pyopenssl"]
+enterprise_cert_extra_require = ["pyopenssl"]
 
-pyopenssl_extra_require = ["pyopenssl>=20.0.0", cryptography_base_require]
+pyopenssl_extra_require = ["pyopenssl>=20.0.0"]
 
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1739): Add bounds for urllib3 and packaging dependencies.
 urllib3_extra_require = ["urllib3", "packaging"]