Consume specific warnings / errors and report accordingly

[anantshri]

• CryptographyDeprecationWarning
• format issue with key file (if the file is not ssh key but openssl)

[ai-anant]

🤖 Watchdog analysis

Issue: cyfinoid/keychecker#11 — Consume specific warnings / errors and report accordingly

Root cause

Two distinct problems were confirmed by reproducing against the current main:

1. CryptographyDeprecationWarning leaks to stderr as a raw Python warning.
   When a key uses a deprecated algorithm (e.g. DSA), cryptography emits a CryptographyDeprecationWarning while serializing the public key. The trigger point is keychecker/core/key_analyzer.py → _generate_public_key_string() → public_key.public_bytes(encoding=serialization.Encoding.OpenSSH, ...) (lines ~290-294). Nothing in analyze_key_file() (lines 29-155) consumed the warning, so the CLI printed an ugly traceback to stderr:

   keychecker/cli.py:168: CryptographyDeprecationWarning: SSH DSA key support is deprecated and will be removed in a future release
   

   Reproduced with openssl genpkey -genparam -algorithm DSA ... + a 1024-bit DSA key: the tool did flag DSA as deprecated in its own security analysis, but the library warning still leaked.

2. OpenSSL PKCS#8 encrypted keys are reported as type: unknown.
   _analyze_encrypted_key() (lines ~157-215) pattern-matches on PEM headers (BEGIN OPENSSH PRIVATE KEY, BEGIN RSA PRIVATE KEY, BEGIN DSA PRIVATE KEY, BEGIN EC PRIVATE KEY, BEGIN PRIVATE KEY) but had no branch for BEGIN ENCRYPTED PRIVATE KEY — OpenSSL's default header for openssl genpkey -aes256 .... Result: passphrase-protected PKCS#8 keys (a very common OpenSSL format) showed Type: unknown instead of pkcs8.

Existing PR status

No PR addressed this issue before this run. The only open PR in the repo at the time was #5 "uv Cache Integration" (by prgyn8), which concerns uv caching/ruff (issue #4) and is unrelated to #11.

Fix — PR #45 (opened by this watchdog)

PR: #45 (Fixes #11)

Changes:

• keychecker/core/key_analyzer.py
  • Wrapped key loading and public-key serialization in warnings.catch_warnings(record=True) and collect CryptographyDeprecationWarning messages; they are now surfaced in the analysis result under a new warnings key.
  • Added a BEGIN ENCRYPTED PRIVATE KEY branch in _analyze_encrypted_key() → type: pkcs8.
• keychecker/utils/output.py — both human-readable formatters now print the captured library deprecation warnings with a ⚠️ prefix.
• tests/test_key_analyzer.py — new tests: DSA analysis captures the deprecation warning without leaking it to the caller; encrypted PKCS#8 detection; normal RSA keys produce no warnings.

Verification

• pytest tests/ → 9 passed (6 original + 3 new)
• black --check keychecker/ tests/ → clean; flake8 keychecker/ tests/ → clean
• Manual CLI check: DSA key now prints ⚠️ SSH DSA key support is deprecated and will be removed in a future release in the output and produces no stderr warning trace; openssl genpkey -aes256 key reports Type: pkcs8.
• PR CI: all jobs pass (test matrix 3.10–3.13, lint, security/Bandit, build, osv-scanner).

Suggested follow-ups (not blocking)

• The warnings list only captures CryptographyDeprecationWarning today. If other UserWarning/DeprecationWarning categories from cryptography (or dependencies) become relevant later, the same catch_warnings(record=True) block can be extended.
• DSA keys are already flagged in the security section; once cryptography drops DSA support entirely, load_* calls for DSA will start raising — worth a dedicated error message when that happens.