Any update here? rsa (https://stuvel.eu/software/rsa/) is officially archived.

I looked a bit closer at the code, and it looks like this change would require a breaking change. Here's an example of some code that would break after this update:

import rsa as rsa_lib
import google.auth.crypt.rsa
# user didn't install optional `cryptography` dependency, so RSASigner and RSAVerifier 
# are imported from google.auth.crypt._python_rsa
signer = google.auth.crypt.rsa.RSASigner(priv_key)
verifier = google.auth.crypt.rsa.RSAVerifier(pub_key)

message = b"Test"

(pub_key, priv_key) = rsa_lib.newkeys(2048)
signature = signer.sign(message)
print(verifier.verify(message, signature))

I don't think there's a way to keep this flow consistent, without requiring rsa as a dependency

One thing we could do is make both rsa and cryptography optional dependencies, and raise an ImportError if both are missing? This would still be a breaking change, since they'll need to update their requirements.txt files. But they could keep using the rsa code in the mean-time.

I think it might be better to do a clean break from rsa though, since it's an archived package. I guess we could instruct users how to copy the old RSASigner/RSAVerifier classes into their codebase if they still want them

Quick update to those following this: This has been released as a pre-release v3.0.0.dev0 build on github and pypi

Switching to draft as there are merge conflicts

Closing in favor of #1929