chore(migration): Migrate code from googleapis/google-auth-library-python-httplib2 into packages/google-auth-httplib2

[parthea]

See #14909.

This PR should be merged with a merge-commit, not a squash-commit, in order to preserve the git history.

[gemini-code-assist]

Code Review

This pull request migrates the google-auth-httplib2 library into this monorepo, including its source code, tests, documentation, and CI/CD configurations. A critical security concern has been identified: several shell scripts in the .kokoro/ directory contain insecure patterns, specifically unquoted environment variable expansions that could lead to command injection and a path traversal vulnerability when handling secrets. These must be addressed to harden the CI environment. Furthermore, the review highlighted a critical issue in the documentation build configuration, a duplicated entry in .gitignore, and opportunities to modernize Python code by removing redundant (object) inheritance. A minor wording improvement in the README is also suggested for clarity. Addressing these points will significantly improve the security, maintainability, and correctness of the new package.

I am having trouble creating individual review comments. Click here to see my feedback.

packages/google-auth-httplib2/docs/conf.py (40)

Hardcoding __version__ to an empty string will cause the documentation to be built with an incorrect or empty version number. It's better to read the version dynamically from setup.py to ensure consistency. You will also need to add import re at the top of the file.

with open(os.path.join(os.path.dirname(__file__), '..', 'setup.py')) as f:
    setup_content = f.read()
match = re.search(r"version = \"([^\"]+)\"", setup_content)
if not match:
    raise RuntimeError('Could not find version in setup.py')
__version__ = match.group(1)

packages/google-auth-httplib2/.kokoro/populate-secrets.sh (28)

The environment variable SECRET_MANAGER_KEYS is expanded without quotes inside a subshell. This allows for command injection if the variable contains shell metacharacters. For example, if SECRET_MANAGER_KEYS is set to ; touch /tmp/owned, the echo command will be terminated and touch will be executed during the subshell evaluation.

for key in $(echo "${SECRET_MANAGER_KEYS}" | sed "s/,/ /g")

packages/google-auth-httplib2/.kokoro/populate-secrets.sh (37)

The key variable, derived from the SECRET_MANAGER_KEYS environment variable, is used to construct a file path for writing secrets without any validation or sanitization. An attacker could provide a key like ../../target_file to overwrite arbitrary files in the CI environment. This is particularly dangerous as it could be used to overwrite executables or configuration files used later in the build process.

packages/google-auth-httplib2/.kokoro/build.sh (57)

The environment variable NOX_SESSION is expanded without quotes in a command. This allows for command injection if the variable contains shell metacharacters like ; or &. While this variable is typically set in configuration files, unquoted expansion is a dangerous pattern in CI scripts.

  python3 -m nox -s "${NOX_SESSION:-}"

packages/google-auth-httplib2/.kokoro/test-samples.sh (34)

The variable LATEST_RELEASE, which contains the output of git describe, is expanded without quotes in a git checkout command. If a malicious tag name is created in the repository (e.g., ; touch /tmp/owned), it could lead to arbitrary command execution when this script runs.

    git checkout "$LATEST_RELEASE"

packages/google-auth-httplib2/.gitignore (39)

The entry coverage.xml is duplicated. It's already present on line 21. You can remove this redundant line to keep the file clean.

packages/google-auth-httplib2/README.rst (7)

The term 'no longer maintained' can be misleading and might suggest the library is abandoned. Since the library is being migrated and will likely receive security patches, using 'deprecated' would be more accurate and consistent with the badge above. It clarifies that while no new features are planned, the library is not completely unmaintained.

The library was created to help clients migrate from `oauth2client <https://github.com/googleapis/oauth2client>`_ to `google-auth`_, however this library is now deprecated. For any new usages please see provided transport layers by `google-auth`_ library.

packages/google-auth-httplib2/google_auth_httplib2.py (132)

Since this library requires Python 3.7+, explicitly inheriting from object is no longer necessary. You can remove (object) for cleaner, more modern Python code.

class AuthorizedHttp:

packages/google-auth-httplib2/tests/test_google_auth_httplib2.py (25)

Since this library requires Python 3.7+, explicitly inheriting from object is no longer necessary. You can remove (object) from class definitions in this file (e.g., MockHttp, MockResponse, TestAuthorizedHttp) for cleaner, more modern Python code.

class MockHttp:

[parthea]

I'm going to try closing and and re-opening this PR to try to get presubmits to run due to Github outage: https://www.githubstatus.com/

[parthea]

Still seeing Expected — Waiting for status to be reported. I'll try again in an hour

[daniel-sanche]

LGTM