Update rsa requirements

[limburgher]

Confirm by changing [ ] to [x] below to ensure that it's a bug:

• [ x] I've gone though the User Guide and the API reference
• [x ] I've searched for previous similar issues and didn't find any solution

Describe the bug
requires rsa <=3.5.0, and 4.6 is now released.

Initial testing with awscli 1.18.95 and rsa 4.6 shows no regressions.

[jekriske-lilly]

+1 on this since https://github.com/sybrenstuvel/python-rsa/blob/master/CHANGELOG.md

Regarding 4.6

No functional changes compared to version 4.2.

Whereas 4.5 is virtually retagged 4.0

[kdaily]

Hi @limburgher and @jekriske-lilly ,

See this PR for a recent change to the RSA requirements: #5355

Now at a max of <=4.5.0 depending on the Python version.

[limburgher]

Thank you. I'm still modifying this on Fedora to work with 4.7.

[jekriske-lilly]

@kdaily Thanks, looking for 4.6 to align with the currently released version on PyPi for which the author claims would still be compatible.

[surfaceowl]

additionally, there are multiple known security issues with older versions of rsa

These have been fixed in rsa versions >=4.2.0 ...and as noted above current version is 4.6.0 (released in June 2020) -- would be great if aws would upgrade this rsa dependency soon because we have pinned the rsa version==4.6.0

Importantly aws-cli==1.18.115 fails to pip install using the new pip dependency resolver currently in beta in pip==20.2.1 (python -m pip install -r requirements.txt --use-feature=2020-resolver). This will fail all the time when pip releases 20.3

[robeden]

Due to the security vulnerabilities (specifically this one), it might be good to think of this as a bug (higher priority).

[nateprewitt]

Hi @robeden, thanks for the ping. We've reviewed the CVE with RSA previously and the CLI isn't impacted. We're blocked on moving the pin until Python 3.4 support is dropped. After our Feb 1, 2021 deprecation date, we're looking at adjusting pins.

[robeden]

Thanks, @nateprewitt - that makes sense. 👍

[koyeung-axaim]

There is an issue when install from the wheel (downloaded from pypi).

(venv) $ python3 --version
Python 3.8.2
(venv) $ pip install awscli-1.19.39-py2.py3-none-any.whl
...
Processing ./awscli-1.19.39-py2.py3-none-any.whl
...
Collecting rsa<=4.5.0,>=3.1.2
  Using cached rsa-4.5-py2.py3-none-any.whl (36 kB)
...
Installing collected packages: PyYAML, jmespath, six, python-dateutil, urllib3, botocore, s3transfer, colorama, pyasn1, rsa, docutils, awscli
Successfully installed PyYAML-5.4.1 awscli-1.19.39 botocore-1.20.39 colorama-0.4.3 docutils-0.15.2 jmespath-0.10.0 pyasn1-0.4.8 python-dateutil-2.8.1 rsa-4.5 s3transfer-0.3.6 six-1.15.0 urllib3-1.26.4
WARNING: You are using pip version 20.0.2; however, version 21.0.1 is available.
You should consider upgrading via the '/tmp/kyeung/20210329/venv/bin/python -m pip install --upgrade pip' command.
(venv) $ 

rsa installed is always 4.5.0.

Although it is coded in setup.py:

if sys.version_info[:2] == (2, 7):
    # Last version of rsa supporting Python 2.7
    install_requires.append('rsa>=3.1.2,<=4.5.0')
else:
    install_requires.append('rsa>=3.1.2,<4.8')

In the awscli-1.19.39.dist-info/METADATA, it is marked as:

Requires-Dist: rsa (<=4.5.0,>=3.1.2)

It might be related to the python version used to build the wheel.

Note: it works as expected (i.e. rsa > 2.5) when it is installed from source, or install from awscli-1.19.17-py2.py3-none-any.whl.

$ egrep -w rsa awscli-1.19.17.dist-info/METADATA
Requires-Dist: rsa>=3.1.2,<=4.5.0; python_version=='2.7'
Requires-Dist: rsa>=3.1.2,<4.8; python_version>='3.6'