feat: Implement identity import command

e2e/tests-dfx/identity_command.bash

@@ -338,3 +338,12 @@ teardown() {
     assert_match "migrating key from"
     assert_eq "$(cat "$TEMPORARY_HOME"/.config/dfx/identity/default/identity.pem)" "$ORIGINAL_KEY"
 }
+
+@test "identity: import" {
+    openssl ecparam -name secp256k1 -genkey -out identity.pem
+    assert_command dfx identity import alice identity.pem
+    assert_match 'Creating identity: "alice".' "$stderr"
+    assert_match 'Created identity: "alice".' "$stderr"
+    assert_command diff identity.pem "$TEMPORARY_HOME/.config/dfx/identity/alice/identity.pem"
+    assert_eq ""
+}

src/dfx/Cargo.toml

@@ -42,6 +42,7 @@ humanize-rs = "0.1.5"
 mime = "0.3.16"
 mockall = "0.6.0"
 net2 = "0.2.34"
+openssl = "0.10.32"
 pem = "0.7.0"
 petgraph = "0.5.0"
 rand = "0.7.2"

src/dfx/src/commands/identity/import.rs

@@ -0,0 +1,28 @@
+use crate::lib::environment::Environment;
+use crate::lib::error::DfxResult;
+use crate::lib::identity::identity_manager::{IdentityCreationParameters, IdentityManager};
+
+use clap::Clap;
+use slog::info;
+use std::path::PathBuf;
+
+/// Creates a new identity from a PEM file.
+#[derive(Clap)]
+pub struct ImportOpts {
+    /// The identity to create.
+    identity: String,
+
+    /// The PEM file to import.
+    pem_file: PathBuf,
+}
+
+/// Executes the import subcommand.
+pub fn exec(env: &dyn Environment, opts: ImportOpts) -> DfxResult {
+    let log = env.get_logger();
+    let name = opts.identity.as_str();
+    info!(log, r#"Creating identity: "{}"."#, name);
+    let params = IdentityCreationParameters::PemFile(opts.pem_file);
+    IdentityManager::new(env)?.create_new_identity(name, params)?;
+    info!(log, r#"Created identity: "{}"."#, name);
+    Ok(())
+}

src/dfx/src/commands/identity/mod.rs

@@ -5,6 +5,7 @@ use clap::Clap;
 
 mod deploy_wallet;
 mod get_wallet;
+mod import;
 mod list;
 mod new;
 mod principal;
@@ -31,6 +32,7 @@ pub struct IdentityOpt {
 enum SubCommand {
     DeployWallet(deploy_wallet::DeployWalletOpts),
     GetWallet(get_wallet::GetWalletOpts),
+    Import(import::ImportOpts),
     List(list::ListOpts),
     New(new::NewIdentityOpts),
     GetPrincipal(principal::GetPrincipalOpts),
@@ -48,6 +50,7 @@ pub fn exec(env: &dyn Environment, opts: IdentityOpt) -> DfxResult {
         SubCommand::List(v) => list::exec(env, v),
         SubCommand::New(v) => new::exec(env, v),
         SubCommand::GetPrincipal(v) => principal::exec(env, v),
+        SubCommand::Import(v) => import::exec(env, v),
         SubCommand::Remove(v) => remove::exec(env, v),
         SubCommand::Rename(v) => rename::exec(env, v),
         SubCommand::SetWallet(v) => set_wallet::exec(env, v, opts.network.clone()),

src/dfx/src/lib/identity/identity_manager.rs

@@ -3,9 +3,10 @@ use crate::lib::environment::Environment;
 use crate::lib::error::{DfxError, DfxResult, IdentityError};
 use crate::lib::identity::Identity as DfxIdentity;
 
-use anyhow::anyhow;
-use anyhow::Context;
+use anyhow::{anyhow, bail, Context};
 use ic_types::Principal;
+use openssl::ec::EcKey;
+use openssl::nid::Nid;
 use pem::{encode, Pem};
 use ring::{rand, signature};
 use serde::{Deserialize, Serialize};
@@ -47,7 +48,7 @@ pub struct HardwareIdentityConfiguration {
 
 pub enum IdentityCreationParameters {
     Pem(),
-
+    PemFile(PathBuf),
     Hardware(HardwareIdentityConfiguration),
 }
 
@@ -391,6 +392,32 @@ pub(super) fn generate_key(pem_file: &Path) -> DfxResult {
     Ok(())
 }
 
+pub(super) fn import_pem_file(src_pem_file: &Path, dst_pem_file: &Path) -> DfxResult {
+    std::fs::copy(&src_pem_file, &dst_pem_file).context(format!(
+        "Cannot copy PEM file from '{}' to '{}'.",
+        PathBuf::from(src_pem_file).display(),
+        PathBuf::from(dst_pem_file).display(),
+    ))?;
+    Ok(())
+}
+
+pub(super) fn validate_pem_file(pem_file: &Path) -> DfxResult {
+    let contents = std::fs::read(&pem_file).context(format!(
+        "Cannot read PEM file at '{}'.",
+        PathBuf::from(pem_file).display()
+    ))?;
+    let private_key = EcKey::private_key_from_pem(&contents).context(format!(
+        "Cannot decode PEM file at '{}'.",
+        PathBuf::from(pem_file).display()
+    ))?;
+    let named_curve = private_key.group().curve_name();
+    let is_secp256k1 = named_curve == Some(Nid::SECP256K1);
+    if !is_secp256k1 {
+        bail!("This functionality is currently restricted to secp256k1 private keys.");
+    }
+    Ok(())
+}
+
 fn encode_pem_private_key(key: &[u8]) -> String {
     let pem = Pem {
         tag: "PRIVATE KEY".to_owned(),

src/dfx/src/lib/identity/mod.rs

@@ -10,7 +10,7 @@ use crate::lib::network::network_descriptor::NetworkDescriptor;
 use crate::lib::waiter::waiter_with_timeout;
 use crate::util;
 
-use anyhow::anyhow;
+use anyhow::{anyhow, bail, Context};
 use ic_agent::identity::BasicIdentity;
 use ic_agent::Signature;
 use ic_identity_hsm::HardwareIdentity;
@@ -64,23 +64,29 @@ impl Identity {
         parameters: IdentityCreationParameters,
     ) -> DfxResult {
         let identity_dir = manager.get_identity_dir_path(name);
-
         if identity_dir.exists() {
-            return Err(DfxError::new(IdentityError::IdentityAlreadyExists()));
+            bail!("Identity already exists.");
         }
-        std::fs::create_dir_all(&identity_dir).map_err(|err| {
-            DfxError::new(IdentityError::CannotCreateIdentityDirectory(
-                identity_dir.clone(),
-                Box::new(DfxError::new(err)),
+        fn create(identity_dir: PathBuf) -> DfxResult {
+            std::fs::create_dir_all(&identity_dir).context(format!(
+                "Cannot create identity directory at '{0}'.",
+                identity_dir.display(),
             ))
-        })?;
-
+        };
         match parameters {
             IdentityCreationParameters::Pem() => {
+                create(identity_dir)?;
                 let pem_file = manager.get_identity_pem_path(name);
                 identity_manager::generate_key(&pem_file)
             }
+            IdentityCreationParameters::PemFile(src_pem_file) => {
+                identity_manager::validate_pem_file(&src_pem_file)?;
+                create(identity_dir)?;
+                let dst_pem_file = manager.get_identity_pem_path(name);
+                identity_manager::import_pem_file(&src_pem_file, &dst_pem_file)
+            }
             IdentityCreationParameters::Hardware(parameters) => {
+                create(identity_dir)?;
                 let identity_configuration = IdentityConfiguration {
                     hsm: Some(parameters),
                 };