woggioni
987fdc0e12
- Replace paramiko-based OpenSSH private key serialization with
cryptography's PrivateFormat.OpenSSH backend.
The old code relied on paramiko.RSAKey, paramiko.DSSKey, etc. to write
private keys, but Paramiko 5.1.0 removed DSSKey entirely and changed
constructor APIs, causing crashes.
- Add explicit fallback path in _load_ssh_private_with_paramiko that
guards against missing DSSKey (getattr paramiko 'DSSKey', append only
when present), modern private_key attribute vs legacy signing_key,
and Ed25519 PyNaCl key material conversion.
- Add two new test coverage methods:
test_ssh_private_roundtrip – round-trip RSA/DSA/EC/Ed25519
unencrypted and password-encrypted, verifying OpenSSH PEM header
and DER preservation.
test_ssh_private_paramiko_fallback – explicitly exercise the
Paramiko fallback for RSA and EC keys, confirming it still works
under locked Paramiko 5.1.0.
Also clean up the comment in load_key_bytes to reflect the new fallback
behavior rather than the old 'encrypted OpenSSH keys not supported' note.
kca-core
Pure, I/O-free PKI domain logic for KCA. It knows how to generate and parse keys, build distinguished names, encode X.509 extensions, issue certificates, create CSRs and CRLs, apply templates, and convert every supported import and export format. It has no kaya, database or filesystem dependencies and is unit-tested in isolation.