Merge pull request #45056 from ericchiang/update-oauth2

Godeps/Godeps.json

@@ -2128,6 +2128,7 @@
 		},
 		{
 			"ImportPath": "github.com/pelletier/go-buffruneio",
+			"Comment": "v0.1.0",
 			"Rev": "df1e16fde7fc330a0ca68167c23bf7ed6ac31d6d"
 		},
 		{
@@ -2604,23 +2605,23 @@
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/google",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/internal",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/jws",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/jwt",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/sys/unix",
@@ -2731,38 +2732,6 @@
 			"Rev": "64485db7e8c8be51e572801d06cdbcfadd3546c1"
 		},
 		{
-			"ImportPath": "google.golang.org/appengine",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/app_identity",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/base",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/datastore",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/log",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/modules",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/remote_api",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
 			"ImportPath": "google.golang.org/grpc",
 			"Comment": "v1.0.4",
 			"Rev": "777daa17ff9b5daef1cfdf915088a2ada3332bf0"

pkg/credentialprovider/gcp/jwt_test.go

@@ -60,7 +60,7 @@ mJAYH8WU+UAy9pecUnDZj14LAGNVmYcse8HFX71MoshnvCTFEPVo4rZxIAGwMpeJ
 5jgQ3slYLpqrGlcbLgUXBUgzEO684Wk/UV9DFPlHALVqCfXQ9dpJPg==
 -----END RSA PRIVATE KEY-----`
 
-	jsonKey = fmt.Sprintf(`{"private_key":"%[1]s", "client_email":"%[2]s"}`,
+	jsonKey = fmt.Sprintf(`{"private_key":"%[1]s", "client_email":"%[2]s", "type": "service_account"}`,
 		strings.Replace(dummyPrivateKey, "\n", "\\n", -1), email)
 )
 

staging/src/k8s.io/client-go/Godeps/Godeps.json

@@ -123,10 +123,6 @@
 			"Rev": "02826c3e79038b59d737d3b1c0a1d937f71a4433"
 		},
 		{
-			"ImportPath": "github.com/golang/protobuf/proto",
-			"Rev": "4bd1920723d7b7c925de087aa32e2187708897f7"
-		},
-		{
 			"ImportPath": "github.com/google/gofuzz",
 			"Rev": "44d81051d367757e1c7c6a5a86423ece9afcf63c"
 		},
@@ -204,23 +200,23 @@
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/google",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/internal",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/jws",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/oauth2/jwt",
-			"Rev": "3c3a985cb79f52a3190fbc056984415ca6763d01"
+			"Rev": "a6bd8cefa1811bd24b86f8902872e4e8225f74c4"
 		},
 		{
 			"ImportPath": "golang.org/x/sys/unix",
@@ -267,38 +263,6 @@
 			"Rev": "2910a502d2bf9e43193af9d68ca516529614eed3"
 		},
 		{
-			"ImportPath": "google.golang.org/appengine",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/app_identity",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/base",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/datastore",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/log",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/modules",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
-			"ImportPath": "google.golang.org/appengine/internal/remote_api",
-			"Rev": "4f7eeb5305a4ba1966344836ba4af9996b7b4e05"
-		},
-		{
 			"ImportPath": "gopkg.in/inf.v0",
 			"Rev": "3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4"
 		},

vendor/BUILD

@@ -349,7 +349,6 @@ filegroup(
         "//vendor/google.golang.org/api/googleapi:all-srcs",
         "//vendor/google.golang.org/api/logging/v2beta1:all-srcs",
         "//vendor/google.golang.org/api/monitoring/v3:all-srcs",
-        "//vendor/google.golang.org/appengine:all-srcs",
         "//vendor/google.golang.org/grpc:all-srcs",
         "//vendor/gopkg.in/gcfg.v1:all-srcs",
         "//vendor/gopkg.in/inf.v0:all-srcs",

vendor/golang.org/x/oauth2/README.md

@@ -63,3 +63,12 @@ with the `oauth2` package.
 		client.Get("...")
 	}
 
+## Contributing
+
+We appreciate your help!
+
+To contribute, please read the contribution guidelines:
+	https://golang.org/doc/contribute.html
+
+Note that the Go project does not use GitHub pull requests but
+uses Gerrit for code reviews. See the contribution guide for details.

vendor/golang.org/x/oauth2/google/appengine.go

@@ -14,12 +14,15 @@ import (
 	"golang.org/x/oauth2"
 )
 
-// Set at init time by appenginevm_hook.go. If true, we are on App Engine Managed VMs.
-var appengineVM bool
+// appengineFlex is set at init time by appengineflex_hook.go. If true, we are on App Engine Flex.
+var appengineFlex bool
 
 // Set at init time by appengine_hook.go. If nil, we're not on App Engine.
 var appengineTokenFunc func(c context.Context, scopes ...string) (token string, expiry time.Time, err error)
 
+// Set at init time by appengine_hook.go. If nil, we're not on App Engine.
+var appengineAppIDFunc func(c context.Context) string
+
 // AppEngineTokenSource returns a token source that fetches tokens
 // issued to the current App Engine application's service account.
 // If you are implementing a 3-legged OAuth 2.0 flow on App Engine

vendor/golang.org/x/oauth2/google/appengine_hook.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build appengine
+// +build appengine appenginevm
 
 package google
 
@@ -10,4 +10,5 @@ import "google.golang.org/appengine"
 
 func init() {
 	appengineTokenFunc = appengine.AccessToken
+	appengineAppIDFunc = appengine.AppID
 }

vendor/golang.org/x/oauth2/google/appenginevm_hook.go → vendor/golang.org/x/oauth2/google/appengineflex_hook.go

-// Copyright 2015 The oauth2 Authors. All rights reserved.
+// Copyright 2015 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
@@ -6,9 +6,6 @@
 
 package google
 
-import "google.golang.org/appengine"
-
 func init() {
-	appengineVM = true
-	appengineTokenFunc = appengine.AccessToken
+	appengineFlex = true // Flex doesn't support appengine.AccessToken; depend on metadata server.
 }

vendor/golang.org/x/oauth2/google/default.go

@@ -6,7 +6,6 @@ package google
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io/ioutil"
 	"net/http"
@@ -17,19 +16,18 @@ import (
 	"cloud.google.com/go/compute/metadata"
 	"golang.org/x/net/context"
 	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/jwt"
 )
 
-// DefaultClient returns an HTTP Client that uses the
-// DefaultTokenSource to obtain authentication credentials.
-//
-// This client should be used when developing services
-// that run on Google App Engine or Google Compute Engine
-// and use "Application Default Credentials."
-//
+// DefaultCredentials holds "Application Default Credentials".
 // For more details, see:
 // https://developers.google.com/accounts/docs/application-default-credentials
-//
+type DefaultCredentials struct {
+	ProjectID   string // may be empty
+	TokenSource oauth2.TokenSource
+}
+
+// DefaultClient returns an HTTP Client that uses the
+// DefaultTokenSource to obtain authentication credentials.
 func DefaultClient(ctx context.Context, scope ...string) (*http.Client, error) {
 	ts, err := DefaultTokenSource(ctx, scope...)
 	if err != nil {
@@ -38,8 +36,18 @@ func DefaultClient(ctx context.Context, scope ...string) (*http.Client, error) {
 	return oauth2.NewClient(ctx, ts), nil
 }
 
-// DefaultTokenSource is a token source that uses
+// DefaultTokenSource returns the token source for
 // "Application Default Credentials".
+// It is a shortcut for FindDefaultCredentials(ctx, scope).TokenSource.
+func DefaultTokenSource(ctx context.Context, scope ...string) (oauth2.TokenSource, error) {
+	creds, err := FindDefaultCredentials(ctx, scope...)
+	if err != nil {
+		return nil, err
+	}
+	return creds.TokenSource, nil
+}
+
+// FindDefaultCredentials searches for "Application Default Credentials".
 //
 // It looks for credentials in the following places,
 // preferring the first location found:
@@ -53,45 +61,40 @@ func DefaultClient(ctx context.Context, scope ...string) (*http.Client, error) {
 //   4. On Google Compute Engine and Google App Engine Managed VMs, it fetches
 //      credentials from the metadata server.
 //      (In this final case any provided scopes are ignored.)
-//
-// For more details, see:
-// https://developers.google.com/accounts/docs/application-default-credentials
-//
-func DefaultTokenSource(ctx context.Context, scope ...string) (oauth2.TokenSource, error) {
+func FindDefaultCredentials(ctx context.Context, scope ...string) (*DefaultCredentials, error) {
 	// First, try the environment variable.
 	const envVar = "GOOGLE_APPLICATION_CREDENTIALS"
 	if filename := os.Getenv(envVar); filename != "" {
-		ts, err := tokenSourceFromFile(ctx, filename, scope)
+		creds, err := readCredentialsFile(ctx, filename, scope)
 		if err != nil {
 			return nil, fmt.Errorf("google: error getting credentials using %v environment variable: %v", envVar, err)
 		}
-		return ts, nil
+		return creds, nil
 	}
 
 	// Second, try a well-known file.
 	filename := wellKnownFile()
-	_, err := os.Stat(filename)
-	if err == nil {
-		ts, err2 := tokenSourceFromFile(ctx, filename, scope)
-		if err2 == nil {
-			return ts, nil
-		}
-		err = err2
-	} else if os.IsNotExist(err) {
-		err = nil // ignore this error
-	}
-	if err != nil {
+	if creds, err := readCredentialsFile(ctx, filename, scope); err == nil {
+		return creds, nil
+	} else if !os.IsNotExist(err) {
 		return nil, fmt.Errorf("google: error getting credentials using well-known file (%v): %v", filename, err)
 	}
 
 	// Third, if we're on Google App Engine use those credentials.
-	if appengineTokenFunc != nil && !appengineVM {
-		return AppEngineTokenSource(ctx, scope...), nil
+	if appengineTokenFunc != nil && !appengineFlex {
+		return &DefaultCredentials{
+			ProjectID:   appengineAppIDFunc(ctx),
+			TokenSource: AppEngineTokenSource(ctx, scope...),
+		}, nil
 	}
 
 	// Fourth, if we're on Google Compute Engine use the metadata server.
 	if metadata.OnGCE() {
-		return ComputeTokenSource(""), nil
+		id, _ := metadata.ProjectID()
+		return &DefaultCredentials{
+			ProjectID:   id,
+			TokenSource: ComputeTokenSource(""),
+		}, nil
 	}
 
 	// None are found; return helpful error.
@@ -107,49 +110,21 @@ func wellKnownFile() string {
 	return filepath.Join(guessUnixHomeDir(), ".config", "gcloud", f)
 }
 
-func tokenSourceFromFile(ctx context.Context, filename string, scopes []string) (oauth2.TokenSource, error) {
+func readCredentialsFile(ctx context.Context, filename string, scopes []string) (*DefaultCredentials, error) {
 	b, err := ioutil.ReadFile(filename)
 	if err != nil {
 		return nil, err
 	}
-	var d struct {
-		// Common fields
-		Type     string
-		ClientID string `json:"client_id"`
-
-		// User Credential fields
-		ClientSecret string `json:"client_secret"`
-		RefreshToken string `json:"refresh_token"`
-
-		// Service Account fields
-		ClientEmail  string `json:"client_email"`
-		PrivateKeyID string `json:"private_key_id"`
-		PrivateKey   string `json:"private_key"`
-	}
-	if err := json.Unmarshal(b, &d); err != nil {
+	var f credentialsFile
+	if err := json.Unmarshal(b, &f); err != nil {
 		return nil, err
 	}
-	switch d.Type {
-	case "authorized_user":
-		cfg := &oauth2.Config{
-			ClientID:     d.ClientID,
-			ClientSecret: d.ClientSecret,
-			Scopes:       append([]string{}, scopes...), // copy
-			Endpoint:     Endpoint,
-		}
-		tok := &oauth2.Token{RefreshToken: d.RefreshToken}
-		return cfg.TokenSource(ctx, tok), nil
-	case "service_account":
-		cfg := &jwt.Config{
-			Email:      d.ClientEmail,
-			PrivateKey: []byte(d.PrivateKey),
-			Scopes:     append([]string{}, scopes...), // copy
-			TokenURL:   JWTTokenURL,
-		}
-		return cfg.TokenSource(ctx), nil
-	case "":
-		return nil, errors.New("missing 'type' field in credentials")
-	default:
-		return nil, fmt.Errorf("unknown credential type: %q", d.Type)
+	ts, err := f.tokenSource(ctx, append([]string(nil), scopes...))
+	if err != nil {
+		return nil, err
 	}
+	return &DefaultCredentials{
+		ProjectID:   f.ProjectID,
+		TokenSource: ts,
+	}, nil
 }

vendor/golang.org/x/oauth2/google/google.go

@@ -22,6 +22,7 @@ import (
 	"time"
 
 	"cloud.google.com/go/compute/metadata"
+	"golang.org/x/net/context"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/jwt"
 )
@@ -85,26 +86,74 @@ func ConfigFromJSON(jsonKey []byte, scope ...string) (*oauth2.Config, error) {
 // Create a service account on "Credentials" for your project at
 // https://console.developers.google.com to download a JSON key file.
 func JWTConfigFromJSON(jsonKey []byte, scope ...string) (*jwt.Config, error) {
-	var key struct {
-		Email        string `json:"client_email"`
-		PrivateKey   string `json:"private_key"`
-		PrivateKeyID string `json:"private_key_id"`
-		TokenURL     string `json:"token_uri"`
-	}
-	if err := json.Unmarshal(jsonKey, &key); err != nil {
+	var f credentialsFile
+	if err := json.Unmarshal(jsonKey, &f); err != nil {
 		return nil, err
 	}
-	config := &jwt.Config{
-		Email:        key.Email,
-		PrivateKey:   []byte(key.PrivateKey),
-		PrivateKeyID: key.PrivateKeyID,
-		Scopes:       scope,
-		TokenURL:     key.TokenURL,
+	if f.Type != serviceAccountKey {
+		return nil, fmt.Errorf("google: read JWT from JSON credentials: 'type' field is %q (expected %q)", f.Type, serviceAccountKey)
 	}
-	if config.TokenURL == "" {
-		config.TokenURL = JWTTokenURL
+	scope = append([]string(nil), scope...) // copy
+	return f.jwtConfig(scope), nil
+}
+
+// JSON key file types.
+const (
+	serviceAccountKey  = "service_account"
+	userCredentialsKey = "authorized_user"
+)
+
+// credentialsFile is the unmarshalled representation of a credentials file.
+type credentialsFile struct {
+	Type string `json:"type"` // serviceAccountKey or userCredentialsKey
+
+	// Service Account fields
+	ClientEmail  string `json:"client_email"`
+	PrivateKeyID string `json:"private_key_id"`
+	PrivateKey   string `json:"private_key"`
+	TokenURL     string `json:"token_uri"`
+	ProjectID    string `json:"project_id"`
+
+	// User Credential fields
+	// (These typically come from gcloud auth.)
+	ClientSecret string `json:"client_secret"`
+	ClientID     string `json:"client_id"`
+	RefreshToken string `json:"refresh_token"`
+}
+
+func (f *credentialsFile) jwtConfig(scopes []string) *jwt.Config {
+	cfg := &jwt.Config{
+		Email:        f.ClientEmail,
+		PrivateKey:   []byte(f.PrivateKey),
+		PrivateKeyID: f.PrivateKeyID,
+		Scopes:       scopes,
+		TokenURL:     f.TokenURL,
+	}
+	if cfg.TokenURL == "" {
+		cfg.TokenURL = JWTTokenURL
+	}
+	return cfg
+}
+
+func (f *credentialsFile) tokenSource(ctx context.Context, scopes []string) (oauth2.TokenSource, error) {
+	switch f.Type {
+	case serviceAccountKey:
+		cfg := f.jwtConfig(scopes)
+		return cfg.TokenSource(ctx), nil
+	case userCredentialsKey:
+		cfg := &oauth2.Config{
+			ClientID:     f.ClientID,
+			ClientSecret: f.ClientSecret,
+			Scopes:       scopes,
+			Endpoint:     Endpoint,
+		}
+		tok := &oauth2.Token{RefreshToken: f.RefreshToken}
+		return cfg.TokenSource(ctx, tok), nil
+	case "":
+		return nil, errors.New("missing 'type' field in credentials")
+	default:
+		return nil, fmt.Errorf("unknown credential type: %q", f.Type)
 	}
-	return config, nil
 }
 
 // ComputeTokenSource returns a token source that fetches access tokens

vendor/golang.org/x/oauth2/google/sdk.go

@@ -160,9 +160,13 @@ var sdkConfigPath = func() (string, error) {
 }
 
 func guessUnixHomeDir() string {
-	usr, err := user.Current()
-	if err == nil {
-		return usr.HomeDir
+	// Prefer $HOME over user.Current due to glibc bug: golang.org/issue/13470
+	if v := os.Getenv("HOME"); v != "" {
+		return v
 	}
-	return os.Getenv("HOME")
+	// Else, fall back to user.Current:
+	if u, err := user.Current(); err == nil {
+		return u.HomeDir
+	}
+	return ""
 }

vendor/golang.org/x/oauth2/internal/oauth2.go

@@ -42,7 +42,7 @@ func ParseKey(key []byte) (*rsa.PrivateKey, error) {
 
 func ParseINI(ini io.Reader) (map[string]map[string]string, error) {
 	result := map[string]map[string]string{
-		"": map[string]string{}, // root section
+		"": {}, // root section
 	}
 	scanner := bufio.NewScanner(ini)
 	currentSection := ""

vendor/golang.org/x/oauth2/internal/token.go

@@ -91,6 +91,7 @@ func (e *expirationTime) UnmarshalJSON(b []byte) error {
 
 var brokenAuthHeaderProviders = []string{
 	"https://accounts.google.com/",
+	"https://api.codeswholesale.com/oauth/token",
 	"https://api.dropbox.com/",
 	"https://api.dropboxapi.com/",
 	"https://api.instagram.com/",
@@ -101,6 +102,7 @@ var brokenAuthHeaderProviders = []string{
 	"https://api.twitch.tv/",
 	"https://app.box.com/",
 	"https://connect.stripe.com/",
+	"https://graph.facebook.com", // see https://github.com/golang/oauth2/issues/214
 	"https://login.microsoftonline.com/",
 	"https://login.salesforce.com/",
 	"https://oauth.sandbox.trainingpeaks.com/",
@@ -117,6 +119,14 @@ var brokenAuthHeaderProviders = []string{
 	"https://www.strava.com/oauth/",
 	"https://www.wunderlist.com/oauth/",
 	"https://api.patreon.com/",
+	"https://sandbox.codeswholesale.com/oauth/token",
+}
+
+// brokenAuthHeaderDomains lists broken providers that issue dynamic endpoints.
+var brokenAuthHeaderDomains = []string{
+	".force.com",
+	".okta.com",
+	".oktapreview.com",
 }
 
 func RegisterBrokenAuthHeaderProvider(tokenURL string) {
@@ -139,6 +149,14 @@ func providerAuthHeaderWorks(tokenURL string) bool {
 		}
 	}
 
+	if u, err := url.Parse(tokenURL); err == nil {
+		for _, s := range brokenAuthHeaderDomains {
+			if strings.HasSuffix(u.Host, s) {
+				return false
+			}
+		}
+	}
+
 	// Assume the provider implements the spec properly
 	// otherwise. We can add more exceptions as they're
 	// discovered. We will _not_ be adding configurable hooks
@@ -151,10 +169,14 @@ func RetrieveToken(ctx context.Context, clientID, clientSecret, tokenURL string,
 	if err != nil {
 		return nil, err
 	}
-	v.Set("client_id", clientID)
 	bustedAuth := !providerAuthHeaderWorks(tokenURL)
-	if bustedAuth && clientSecret != "" {
-		v.Set("client_secret", clientSecret)
+	if bustedAuth {
+		if clientID != "" {
+			v.Set("client_id", clientID)
+		}
+		if clientSecret != "" {
+			v.Set("client_secret", clientSecret)
+		}
 	}
 	req, err := http.NewRequest("POST", tokenURL, strings.NewReader(v.Encode()))
 	if err != nil {

vendor/golang.org/x/oauth2/jwt/jwt.go

@@ -105,7 +105,9 @@ func (js jwtSource) Token() (*oauth2.Token, error) {
 	if t := js.conf.Expires; t > 0 {
 		claimSet.Exp = time.Now().Add(t).Unix()
 	}
-	payload, err := jws.Encode(defaultHeader, claimSet, pk)
+	h := *defaultHeader
+	h.KeyID = js.conf.PrivateKeyID
+	payload, err := jws.Encode(&h, claimSet, pk)
 	if err != nil {
 		return nil, err
 	}

vendor/golang.org/x/oauth2/oauth2.go

@@ -180,7 +180,6 @@ func (c *Config) Exchange(ctx context.Context, code string) (*Token, error) {
 		"grant_type":   {"authorization_code"},
 		"code":         {code},
 		"redirect_uri": internal.CondVal(c.RedirectURL),
-		"scope":        internal.CondVal(strings.Join(c.Scopes, " ")),
 	})
 }
 

vendor/google.golang.org/appengine/.travis.yml

-language: go
-
-go:
-  - 1.6.3
-  - 1.7rc6
-
-install:
-  - go get -v -t -d google.golang.org/appengine/...
-  - mkdir sdk
-  - curl -o sdk.zip "https://storage.googleapis.com/appengine-sdks/featured/go_appengine_sdk_linux_amd64-1.9.40.zip"
-  - unzip sdk.zip -d sdk
-  - export APPENGINE_DEV_APPSERVER=$(pwd)/sdk/go_appengine/dev_appserver.py
-
-script:
-  - go version
-  - go test -v google.golang.org/appengine/...
-  - go test -v -race google.golang.org/appengine/...
-  - sdk/go_appengine/goapp test -v google.golang.org/appengine/...

vendor/google.golang.org/appengine/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "appengine.go",
-        "appengine_vm.go",
-        "errors.go",
-        "identity.go",
-        "namespace.go",
-        "timeout.go",
-    ],
-    tags = ["automanaged"],
-    deps = [
-        "//vendor/github.com/golang/protobuf/proto:go_default_library",
-        "//vendor/golang.org/x/net/context:go_default_library",
-        "//vendor/google.golang.org/appengine/internal:go_default_library",
-        "//vendor/google.golang.org/appengine/internal/app_identity:go_default_library",
-        "//vendor/google.golang.org/appengine/internal/modules:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [
-        ":package-srcs",
-        "//vendor/google.golang.org/appengine/internal:all-srcs",
-    ],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/README.md

-# Go App Engine packages
-
-[![Build Status](https://travis-ci.org/golang/appengine.svg)](https://travis-ci.org/golang/appengine)
-
-This repository supports the Go runtime on App Engine,
-including both the standard App Engine and the
-"App Engine flexible environment" (formerly known as "Managed VMs").
-It provides APIs for interacting with App Engine services.
-Its canonical import path is `google.golang.org/appengine`.
-
-See https://cloud.google.com/appengine/docs/go/
-for more information.
-
-File issue reports and feature requests on the [Google App Engine issue
-tracker](https://code.google.com/p/googleappengine/issues/entry?template=Go%20defect).
-
-## Directory structure
-The top level directory of this repository is the `appengine` package. It
-contains the
-basic APIs (e.g. `appengine.NewContext`) that apply across APIs. Specific API
-packages are in subdirectories (e.g. `datastore`).
-
-There is an `internal` subdirectory that contains service protocol buffers,
-plus packages required for connectivity to make API calls. App Engine apps
-should not directly import any package under `internal`.
-
-## Updating a Go App Engine app
-
-This section describes how to update an older Go App Engine app to use
-these packages. A provided tool, `aefix`, can help automate steps 2 and 3
-(run `go get google.golang.org/appengine/cmd/aefix` to install it), but
-read the details below since `aefix` can't perform all the changes.
-
-### 1. Update YAML files (App Engine flexible environment / Managed VMs only)
-
-The `app.yaml` file (and YAML files for modules) should have these new lines added:
-```
-vm: true
-```
-See https://cloud.google.com/appengine/docs/go/modules/#Go_Instance_scaling_and_class for details.
-
-### 2. Update import paths
-
-The import paths for App Engine packages are now fully qualified, based at `google.golang.org/appengine`.
-You will need to update your code to use import paths starting with that; for instance,
-code importing `appengine/datastore` will now need to import `google.golang.org/appengine/datastore`.
-
-### 3. Update code using deprecated, removed or modified APIs
-
-Most App Engine services are available with exactly the same API.
-A few APIs were cleaned up, and some are not available yet.
-This list summarises the differences:
-
-* `appengine.Context` has been replaced with the `Context` type from `golang.org/x/net/context`.
-* Logging methods that were on `appengine.Context` are now functions in `google.golang.org/appengine/log`.
-* `appengine.Timeout` has been removed. Use `context.WithTimeout` instead.
-* `appengine.Datacenter` now takes a `context.Context` argument.
-* `datastore.PropertyLoadSaver` has been simplified to use slices in place of channels.
-* `delay.Call` now returns an error.
-* `search.FieldLoadSaver` now handles document metadata.
-* `urlfetch.Transport` no longer has a Deadline field; set a deadline on the
-  `context.Context` instead.
-* `aetest` no longer declares its own Context type, and uses the standard one instead.
-* `taskqueue.QueueStats` no longer takes a maxTasks argument. That argument has been
-  deprecated and unused for a long time.
-* `appengine.BackendHostname` and `appengine.BackendInstance` were for the deprecated backends feature.
-  Use `appengine.ModuleHostname`and `appengine.ModuleName` instead.
-* Most of `appengine/file` and parts of `appengine/blobstore` are deprecated.
-  Use [Google Cloud Storage](https://godoc.org/google.golang.org/cloud/storage) instead.
-* `appengine/socket` is not required on App Engine flexible environment / Managed VMs.
-  Use the standard `net` package instead.

vendor/google.golang.org/appengine/appengine.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// Package appengine provides basic functionality for Google App Engine.
-//
-// For more information on how to write Go apps for Google App Engine, see:
-// https://cloud.google.com/appengine/docs/go/
-package appengine
-
-import (
-	"net/http"
-
-	"github.com/golang/protobuf/proto"
-	"golang.org/x/net/context"
-
-	"google.golang.org/appengine/internal"
-)
-
-// The gophers party all night; the rabbits provide the beats.
-
-// Main is the principal entry point for an app running in App Engine.
-//
-// On App Engine Flexible it installs a trivial health checker if one isn't
-// already registered, and starts listening on port 8080 (overridden by the
-// $PORT environment variable).
-//
-// See https://cloud.google.com/appengine/docs/flexible/custom-runtimes#health_check_requests
-// for details on how to do your own health checking.
-//
-// Main is not yet supported on App Engine Standard.
-//
-// Main never returns.
-//
-// Main is designed so that the app's main package looks like this:
-//
-//      package main
-//
-//      import (
-//              "google.golang.org/appengine"
-//
-//              _ "myapp/package0"
-//              _ "myapp/package1"
-//      )
-//
-//      func main() {
-//              appengine.Main()
-//      }
-//
-// The "myapp/packageX" packages are expected to register HTTP handlers
-// in their init functions.
-func Main() {
-	internal.Main()
-}
-
-// IsDevAppServer reports whether the App Engine app is running in the
-// development App Server.
-func IsDevAppServer() bool {
-	return internal.IsDevAppServer()
-}
-
-// NewContext returns a context for an in-flight HTTP request.
-// This function is cheap.
-func NewContext(req *http.Request) context.Context {
-	return WithContext(context.Background(), req)
-}
-
-// WithContext returns a copy of the parent context
-// and associates it with an in-flight HTTP request.
-// This function is cheap.
-func WithContext(parent context.Context, req *http.Request) context.Context {
-	return internal.WithContext(parent, req)
-}
-
-// TODO(dsymonds): Add a Call function here? Otherwise other packages can't access internal.Call.
-
-// BlobKey is a key for a blobstore blob.
-//
-// Conceptually, this type belongs in the blobstore package, but it lives in
-// the appengine package to avoid a circular dependency: blobstore depends on
-// datastore, and datastore needs to refer to the BlobKey type.
-type BlobKey string
-
-// GeoPoint represents a location as latitude/longitude in degrees.
-type GeoPoint struct {
-	Lat, Lng float64
-}
-
-// Valid returns whether a GeoPoint is within [-90, 90] latitude and [-180, 180] longitude.
-func (g GeoPoint) Valid() bool {
-	return -90 <= g.Lat && g.Lat <= 90 && -180 <= g.Lng && g.Lng <= 180
-}
-
-// APICallFunc defines a function type for handling an API call.
-// See WithCallOverride.
-type APICallFunc func(ctx context.Context, service, method string, in, out proto.Message) error
-
-// WithAPICallFunc returns a copy of the parent context
-// that will cause API calls to invoke f instead of their normal operation.
-//
-// This is intended for advanced users only.
-func WithAPICallFunc(ctx context.Context, f APICallFunc) context.Context {
-	return internal.WithCallOverride(ctx, internal.CallOverrideFunc(f))
-}
-
-// APICall performs an API call.
-//
-// This is not intended for general use; it is exported for use in conjunction
-// with WithAPICallFunc.
-func APICall(ctx context.Context, service, method string, in, out proto.Message) error {
-	return internal.Call(ctx, service, method, in, out)
-}

vendor/google.golang.org/appengine/appengine_vm.go

-// Copyright 2015 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// +build !appengine
-
-package appengine
-
-import (
-	"golang.org/x/net/context"
-
-	"google.golang.org/appengine/internal"
-)
-
-// BackgroundContext returns a context not associated with a request.
-// This should only be used when not servicing a request.
-// This only works in App Engine "flexible environment".
-func BackgroundContext() context.Context {
-	return internal.BackgroundContext()
-}

vendor/google.golang.org/appengine/errors.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// This file provides error functions for common API failure modes.
-
-package appengine
-
-import (
-	"fmt"
-
-	"google.golang.org/appengine/internal"
-)
-
-// IsOverQuota reports whether err represents an API call failure
-// due to insufficient available quota.
-func IsOverQuota(err error) bool {
-	callErr, ok := err.(*internal.CallError)
-	return ok && callErr.Code == 4
-}
-
-// MultiError is returned by batch operations when there are errors with
-// particular elements. Errors will be in a one-to-one correspondence with
-// the input elements; successful elements will have a nil entry.
-type MultiError []error
-
-func (m MultiError) Error() string {
-	s, n := "", 0
-	for _, e := range m {
-		if e != nil {
-			if n == 0 {
-				s = e.Error()
-			}
-			n++
-		}
-	}
-	switch n {
-	case 0:
-		return "(0 errors)"
-	case 1:
-		return s
-	case 2:
-		return s + " (and 1 other error)"
-	}
-	return fmt.Sprintf("%s (and %d other errors)", s, n-1)
-}

vendor/google.golang.org/appengine/identity.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package appengine
-
-import (
-	"time"
-
-	"golang.org/x/net/context"
-
-	"google.golang.org/appengine/internal"
-	pb "google.golang.org/appengine/internal/app_identity"
-	modpb "google.golang.org/appengine/internal/modules"
-)
-
-// AppID returns the application ID for the current application.
-// The string will be a plain application ID (e.g. "appid"), with a
-// domain prefix for custom domain deployments (e.g. "example.com:appid").
-func AppID(c context.Context) string { return internal.AppID(c) }
-
-// DefaultVersionHostname returns the standard hostname of the default version
-// of the current application (e.g. "my-app.appspot.com"). This is suitable for
-// use in constructing URLs.
-func DefaultVersionHostname(c context.Context) string {
-	return internal.DefaultVersionHostname(c)
-}
-
-// ModuleName returns the module name of the current instance.
-func ModuleName(c context.Context) string {
-	return internal.ModuleName(c)
-}
-
-// ModuleHostname returns a hostname of a module instance.
-// If module is the empty string, it refers to the module of the current instance.
-// If version is empty, it refers to the version of the current instance if valid,
-// or the default version of the module of the current instance.
-// If instance is empty, ModuleHostname returns the load-balancing hostname.
-func ModuleHostname(c context.Context, module, version, instance string) (string, error) {
-	req := &modpb.GetHostnameRequest{}
-	if module != "" {
-		req.Module = &module
-	}
-	if version != "" {
-		req.Version = &version
-	}
-	if instance != "" {
-		req.Instance = &instance
-	}
-	res := &modpb.GetHostnameResponse{}
-	if err := internal.Call(c, "modules", "GetHostname", req, res); err != nil {
-		return "", err
-	}
-	return *res.Hostname, nil
-}
-
-// VersionID returns the version ID for the current application.
-// It will be of the form "X.Y", where X is specified in app.yaml,
-// and Y is a number generated when each version of the app is uploaded.
-// It does not include a module name.
-func VersionID(c context.Context) string { return internal.VersionID(c) }
-
-// InstanceID returns a mostly-unique identifier for this instance.
-func InstanceID() string { return internal.InstanceID() }
-
-// Datacenter returns an identifier for the datacenter that the instance is running in.
-func Datacenter(c context.Context) string { return internal.Datacenter(c) }
-
-// ServerSoftware returns the App Engine release version.
-// In production, it looks like "Google App Engine/X.Y.Z".
-// In the development appserver, it looks like "Development/X.Y".
-func ServerSoftware() string { return internal.ServerSoftware() }
-
-// RequestID returns a string that uniquely identifies the request.
-func RequestID(c context.Context) string { return internal.RequestID(c) }
-
-// AccessToken generates an OAuth2 access token for the specified scopes on
-// behalf of service account of this application. This token will expire after
-// the returned time.
-func AccessToken(c context.Context, scopes ...string) (token string, expiry time.Time, err error) {
-	req := &pb.GetAccessTokenRequest{Scope: scopes}
-	res := &pb.GetAccessTokenResponse{}
-
-	err = internal.Call(c, "app_identity_service", "GetAccessToken", req, res)
-	if err != nil {
-		return "", time.Time{}, err
-	}
-	return res.GetAccessToken(), time.Unix(res.GetExpirationTime(), 0), nil
-}
-
-// Certificate represents a public certificate for the app.
-type Certificate struct {
-	KeyName string
-	Data    []byte // PEM-encoded X.509 certificate
-}
-
-// PublicCertificates retrieves the public certificates for the app.
-// They can be used to verify a signature returned by SignBytes.
-func PublicCertificates(c context.Context) ([]Certificate, error) {
-	req := &pb.GetPublicCertificateForAppRequest{}
-	res := &pb.GetPublicCertificateForAppResponse{}
-	if err := internal.Call(c, "app_identity_service", "GetPublicCertificatesForApp", req, res); err != nil {
-		return nil, err
-	}
-	var cs []Certificate
-	for _, pc := range res.PublicCertificateList {
-		cs = append(cs, Certificate{
-			KeyName: pc.GetKeyName(),
-			Data:    []byte(pc.GetX509CertificatePem()),
-		})
-	}
-	return cs, nil
-}
-
-// ServiceAccount returns a string representing the service account name, in
-// the form of an email address (typically app_id@appspot.gserviceaccount.com).
-func ServiceAccount(c context.Context) (string, error) {
-	req := &pb.GetServiceAccountNameRequest{}
-	res := &pb.GetServiceAccountNameResponse{}
-
-	err := internal.Call(c, "app_identity_service", "GetServiceAccountName", req, res)
-	if err != nil {
-		return "", err
-	}
-	return res.GetServiceAccountName(), err
-}
-
-// SignBytes signs bytes using a private key unique to your application.
-func SignBytes(c context.Context, bytes []byte) (keyName string, signature []byte, err error) {
-	req := &pb.SignForAppRequest{BytesToSign: bytes}
-	res := &pb.SignForAppResponse{}
-
-	if err := internal.Call(c, "app_identity_service", "SignForApp", req, res); err != nil {
-		return "", nil, err
-	}
-	return res.GetKeyName(), res.GetSignatureBytes(), nil
-}
-
-func init() {
-	internal.RegisterErrorCodeMap("app_identity_service", pb.AppIdentityServiceError_ErrorCode_name)
-	internal.RegisterErrorCodeMap("modules", modpb.ModulesServiceError_ErrorCode_name)
-}

vendor/google.golang.org/appengine/internal/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = [
-        "api.go",
-        "api_common.go",
-        "app_id.go",
-        "identity.go",
-        "identity_vm.go",
-        "internal.go",
-        "main_vm.go",
-        "metadata.go",
-        "net.go",
-        "transaction.go",
-    ],
-    tags = ["automanaged"],
-    deps = [
-        "//vendor/github.com/golang/protobuf/proto:go_default_library",
-        "//vendor/golang.org/x/net/context:go_default_library",
-        "//vendor/google.golang.org/appengine/internal/base:go_default_library",
-        "//vendor/google.golang.org/appengine/internal/datastore:go_default_library",
-        "//vendor/google.golang.org/appengine/internal/log:go_default_library",
-        "//vendor/google.golang.org/appengine/internal/remote_api:go_default_library",
-    ],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [
-        ":package-srcs",
-        "//vendor/google.golang.org/appengine/internal/app_identity:all-srcs",
-        "//vendor/google.golang.org/appengine/internal/base:all-srcs",
-        "//vendor/google.golang.org/appengine/internal/datastore:all-srcs",
-        "//vendor/google.golang.org/appengine/internal/log:all-srcs",
-        "//vendor/google.golang.org/appengine/internal/modules:all-srcs",
-        "//vendor/google.golang.org/appengine/internal/remote_api:all-srcs",
-    ],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/internal/api_classic.go

-// Copyright 2015 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// +build appengine
-
-package internal
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"time"
-
-	"appengine"
-	"appengine_internal"
-	basepb "appengine_internal/base"
-
-	"github.com/golang/protobuf/proto"
-	netcontext "golang.org/x/net/context"
-)
-
-var contextKey = "holds an appengine.Context"
-
-func fromContext(ctx netcontext.Context) appengine.Context {
-	c, _ := ctx.Value(&contextKey).(appengine.Context)
-	return c
-}
-
-// This is only for classic App Engine adapters.
-func ClassicContextFromContext(ctx netcontext.Context) appengine.Context {
-	return fromContext(ctx)
-}
-
-func withContext(parent netcontext.Context, c appengine.Context) netcontext.Context {
-	ctx := netcontext.WithValue(parent, &contextKey, c)
-
-	s := &basepb.StringProto{}
-	c.Call("__go__", "GetNamespace", &basepb.VoidProto{}, s, nil)
-	if ns := s.GetValue(); ns != "" {
-		ctx = NamespacedContext(ctx, ns)
-	}
-
-	return ctx
-}
-
-func IncomingHeaders(ctx netcontext.Context) http.Header {
-	if c := fromContext(ctx); c != nil {
-		if req, ok := c.Request().(*http.Request); ok {
-			return req.Header
-		}
-	}
-	return nil
-}
-
-func WithContext(parent netcontext.Context, req *http.Request) netcontext.Context {
-	c := appengine.NewContext(req)
-	return withContext(parent, c)
-}
-
-type testingContext struct {
-	appengine.Context
-
-	req *http.Request
-}
-
-func (t *testingContext) FullyQualifiedAppID() string { return "dev~testcontext" }
-func (t *testingContext) Call(service, method string, _, _ appengine_internal.ProtoMessage, _ *appengine_internal.CallOptions) error {
-	if service == "__go__" && method == "GetNamespace" {
-		return nil
-	}
-	return fmt.Errorf("testingContext: unsupported Call")
-}
-func (t *testingContext) Request() interface{} { return t.req }
-
-func ContextForTesting(req *http.Request) netcontext.Context {
-	return withContext(netcontext.Background(), &testingContext{req: req})
-}
-
-func Call(ctx netcontext.Context, service, method string, in, out proto.Message) error {
-	if ns := NamespaceFromContext(ctx); ns != "" {
-		if fn, ok := NamespaceMods[service]; ok {
-			fn(in, ns)
-		}
-	}
-
-	if f, ctx, ok := callOverrideFromContext(ctx); ok {
-		return f(ctx, service, method, in, out)
-	}
-
-	// Handle already-done contexts quickly.
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	default:
-	}
-
-	c := fromContext(ctx)
-	if c == nil {
-		// Give a good error message rather than a panic lower down.
-		return errors.New("not an App Engine context")
-	}
-
-	// Apply transaction modifications if we're in a transaction.
-	if t := transactionFromContext(ctx); t != nil {
-		if t.finished {
-			return errors.New("transaction context has expired")
-		}
-		applyTransaction(in, &t.transaction)
-	}
-
-	var opts *appengine_internal.CallOptions
-	if d, ok := ctx.Deadline(); ok {
-		opts = &appengine_internal.CallOptions{
-			Timeout: d.Sub(time.Now()),
-		}
-	}
-
-	err := c.Call(service, method, in, out, opts)
-	switch v := err.(type) {
-	case *appengine_internal.APIError:
-		return &APIError{
-			Service: v.Service,
-			Detail:  v.Detail,
-			Code:    v.Code,
-		}
-	case *appengine_internal.CallError:
-		return &CallError{
-			Detail:  v.Detail,
-			Code:    v.Code,
-			Timeout: v.Timeout,
-		}
-	}
-	return err
-}
-
-func handleHTTP(w http.ResponseWriter, r *http.Request) {
-	panic("handleHTTP called; this should be impossible")
-}
-
-func logf(c appengine.Context, level int64, format string, args ...interface{}) {
-	var fn func(format string, args ...interface{})
-	switch level {
-	case 0:
-		fn = c.Debugf
-	case 1:
-		fn = c.Infof
-	case 2:
-		fn = c.Warningf
-	case 3:
-		fn = c.Errorf
-	case 4:
-		fn = c.Criticalf
-	default:
-		// This shouldn't happen.
-		fn = c.Criticalf
-	}
-	fn(format, args...)
-}

vendor/google.golang.org/appengine/internal/api_common.go

-// Copyright 2015 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package internal
-
-import (
-	"github.com/golang/protobuf/proto"
-	netcontext "golang.org/x/net/context"
-)
-
-type CallOverrideFunc func(ctx netcontext.Context, service, method string, in, out proto.Message) error
-
-var callOverrideKey = "holds []CallOverrideFunc"
-
-func WithCallOverride(ctx netcontext.Context, f CallOverrideFunc) netcontext.Context {
-	// We avoid appending to any existing call override
-	// so we don't risk overwriting a popped stack below.
-	var cofs []CallOverrideFunc
-	if uf, ok := ctx.Value(&callOverrideKey).([]CallOverrideFunc); ok {
-		cofs = append(cofs, uf...)
-	}
-	cofs = append(cofs, f)
-	return netcontext.WithValue(ctx, &callOverrideKey, cofs)
-}
-
-func callOverrideFromContext(ctx netcontext.Context) (CallOverrideFunc, netcontext.Context, bool) {
-	cofs, _ := ctx.Value(&callOverrideKey).([]CallOverrideFunc)
-	if len(cofs) == 0 {
-		return nil, nil, false
-	}
-	// We found a list of overrides; grab the last, and reconstitute a
-	// context that will hide it.
-	f := cofs[len(cofs)-1]
-	ctx = netcontext.WithValue(ctx, &callOverrideKey, cofs[:len(cofs)-1])
-	return f, ctx, true
-}
-
-type logOverrideFunc func(level int64, format string, args ...interface{})
-
-var logOverrideKey = "holds a logOverrideFunc"
-
-func WithLogOverride(ctx netcontext.Context, f logOverrideFunc) netcontext.Context {
-	return netcontext.WithValue(ctx, &logOverrideKey, f)
-}
-
-var appIDOverrideKey = "holds a string, being the full app ID"
-
-func WithAppIDOverride(ctx netcontext.Context, appID string) netcontext.Context {
-	return netcontext.WithValue(ctx, &appIDOverrideKey, appID)
-}
-
-var namespaceKey = "holds the namespace string"
-
-func withNamespace(ctx netcontext.Context, ns string) netcontext.Context {
-	return netcontext.WithValue(ctx, &namespaceKey, ns)
-}
-
-func NamespaceFromContext(ctx netcontext.Context) string {
-	// If there's no namespace, return the empty string.
-	ns, _ := ctx.Value(&namespaceKey).(string)
-	return ns
-}
-
-// FullyQualifiedAppID returns the fully-qualified application ID.
-// This may contain a partition prefix (e.g. "s~" for High Replication apps),
-// or a domain prefix (e.g. "example.com:").
-func FullyQualifiedAppID(ctx netcontext.Context) string {
-	if id, ok := ctx.Value(&appIDOverrideKey).(string); ok {
-		return id
-	}
-	return fullyQualifiedAppID(ctx)
-}
-
-func Logf(ctx netcontext.Context, level int64, format string, args ...interface{}) {
-	if f, ok := ctx.Value(&logOverrideKey).(logOverrideFunc); ok {
-		f(level, format, args...)
-		return
-	}
-	logf(fromContext(ctx), level, format, args...)
-}
-
-// NamespacedContext wraps a Context to support namespaces.
-func NamespacedContext(ctx netcontext.Context, namespace string) netcontext.Context {
-	return withNamespace(ctx, namespace)
-}

vendor/google.golang.org/appengine/internal/app_id.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package internal
-
-import (
-	"strings"
-)
-
-func parseFullAppID(appid string) (partition, domain, displayID string) {
-	if i := strings.Index(appid, "~"); i != -1 {
-		partition, appid = appid[:i], appid[i+1:]
-	}
-	if i := strings.Index(appid, ":"); i != -1 {
-		domain, appid = appid[:i], appid[i+1:]
-	}
-	return partition, domain, appid
-}
-
-// appID returns "appid" or "domain.com:appid".
-func appID(fullAppID string) string {
-	_, dom, dis := parseFullAppID(fullAppID)
-	if dom != "" {
-		return dom + ":" + dis
-	}
-	return dis
-}

vendor/google.golang.org/appengine/internal/app_identity/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["app_identity_service.pb.go"],
-    tags = ["automanaged"],
-    deps = ["//vendor/github.com/golang/protobuf/proto:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/internal/app_identity/app_identity_service.proto

-syntax = "proto2";
-option go_package = "app_identity";
-
-package appengine;
-
-message AppIdentityServiceError {
-  enum ErrorCode {
-    SUCCESS = 0;
-    UNKNOWN_SCOPE = 9;
-    BLOB_TOO_LARGE = 1000;
-    DEADLINE_EXCEEDED = 1001;
-    NOT_A_VALID_APP = 1002;
-    UNKNOWN_ERROR = 1003;
-    NOT_ALLOWED = 1005;
-    NOT_IMPLEMENTED = 1006;
-  }
-}
-
-message SignForAppRequest {
-  optional bytes bytes_to_sign = 1;
-}
-
-message SignForAppResponse {
-  optional string key_name = 1;
-  optional bytes signature_bytes = 2;
-}
-
-message GetPublicCertificateForAppRequest {
-}
-
-message PublicCertificate {
-  optional string key_name = 1;
-  optional string x509_certificate_pem = 2;
-}
-
-message GetPublicCertificateForAppResponse {
-  repeated PublicCertificate public_certificate_list = 1;
-  optional int64 max_client_cache_time_in_second = 2;
-}
-
-message GetServiceAccountNameRequest {
-}
-
-message GetServiceAccountNameResponse {
-  optional string service_account_name = 1;
-}
-
-message GetAccessTokenRequest {
-  repeated string scope = 1;
-  optional int64 service_account_id = 2;
-  optional string service_account_name = 3;
-}
-
-message GetAccessTokenResponse {
-  optional string access_token = 1;
-  optional int64 expiration_time = 2;
-}
-
-message GetDefaultGcsBucketNameRequest {
-}
-
-message GetDefaultGcsBucketNameResponse {
-  optional string default_gcs_bucket_name = 1;
-}

vendor/google.golang.org/appengine/internal/base/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["api_base.pb.go"],
-    tags = ["automanaged"],
-    deps = ["//vendor/github.com/golang/protobuf/proto:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/internal/base/api_base.pb.go

-// Code generated by protoc-gen-go.
-// source: google.golang.org/appengine/internal/base/api_base.proto
-// DO NOT EDIT!
-
-/*
-Package base is a generated protocol buffer package.
-
-It is generated from these files:
-	google.golang.org/appengine/internal/base/api_base.proto
-
-It has these top-level messages:
-	StringProto
-	Integer32Proto
-	Integer64Proto
-	BoolProto
-	DoubleProto
-	BytesProto
-	VoidProto
-*/
-package base
-
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-type StringProto struct {
-	Value            *string `protobuf:"bytes,1,req,name=value" json:"value,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *StringProto) Reset()         { *m = StringProto{} }
-func (m *StringProto) String() string { return proto.CompactTextString(m) }
-func (*StringProto) ProtoMessage()    {}
-
-func (m *StringProto) GetValue() string {
-	if m != nil && m.Value != nil {
-		return *m.Value
-	}
-	return ""
-}
-
-type Integer32Proto struct {
-	Value            *int32 `protobuf:"varint,1,req,name=value" json:"value,omitempty"`
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *Integer32Proto) Reset()         { *m = Integer32Proto{} }
-func (m *Integer32Proto) String() string { return proto.CompactTextString(m) }
-func (*Integer32Proto) ProtoMessage()    {}
-
-func (m *Integer32Proto) GetValue() int32 {
-	if m != nil && m.Value != nil {
-		return *m.Value
-	}
-	return 0
-}
-
-type Integer64Proto struct {
-	Value            *int64 `protobuf:"varint,1,req,name=value" json:"value,omitempty"`
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *Integer64Proto) Reset()         { *m = Integer64Proto{} }
-func (m *Integer64Proto) String() string { return proto.CompactTextString(m) }
-func (*Integer64Proto) ProtoMessage()    {}
-
-func (m *Integer64Proto) GetValue() int64 {
-	if m != nil && m.Value != nil {
-		return *m.Value
-	}
-	return 0
-}
-
-type BoolProto struct {
-	Value            *bool  `protobuf:"varint,1,req,name=value" json:"value,omitempty"`
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *BoolProto) Reset()         { *m = BoolProto{} }
-func (m *BoolProto) String() string { return proto.CompactTextString(m) }
-func (*BoolProto) ProtoMessage()    {}
-
-func (m *BoolProto) GetValue() bool {
-	if m != nil && m.Value != nil {
-		return *m.Value
-	}
-	return false
-}
-
-type DoubleProto struct {
-	Value            *float64 `protobuf:"fixed64,1,req,name=value" json:"value,omitempty"`
-	XXX_unrecognized []byte   `json:"-"`
-}
-
-func (m *DoubleProto) Reset()         { *m = DoubleProto{} }
-func (m *DoubleProto) String() string { return proto.CompactTextString(m) }
-func (*DoubleProto) ProtoMessage()    {}
-
-func (m *DoubleProto) GetValue() float64 {
-	if m != nil && m.Value != nil {
-		return *m.Value
-	}
-	return 0
-}
-
-type BytesProto struct {
-	Value            []byte `protobuf:"bytes,1,req,name=value" json:"value,omitempty"`
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *BytesProto) Reset()         { *m = BytesProto{} }
-func (m *BytesProto) String() string { return proto.CompactTextString(m) }
-func (*BytesProto) ProtoMessage()    {}
-
-func (m *BytesProto) GetValue() []byte {
-	if m != nil {
-		return m.Value
-	}
-	return nil
-}
-
-type VoidProto struct {
-	XXX_unrecognized []byte `json:"-"`
-}
-
-func (m *VoidProto) Reset()         { *m = VoidProto{} }
-func (m *VoidProto) String() string { return proto.CompactTextString(m) }
-func (*VoidProto) ProtoMessage()    {}

vendor/google.golang.org/appengine/internal/base/api_base.proto

-// Built-in base types for API calls. Primarily useful as return types.
-
-syntax = "proto2";
-option go_package = "base";
-
-package appengine.base;
-
-message StringProto {
-  required string value = 1;
-}
-
-message Integer32Proto {
-  required int32 value = 1;
-}
-
-message Integer64Proto {
-  required int64 value = 1;
-}
-
-message BoolProto {
-  required bool value = 1;
-}
-
-message DoubleProto {
-  required double value = 1;
-}
-
-message BytesProto {
-  required bytes value = 1 [ctype=CORD];
-}
-
-message VoidProto {
-}

vendor/google.golang.org/appengine/internal/datastore/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["datastore_v3.pb.go"],
-    tags = ["automanaged"],
-    deps = ["//vendor/github.com/golang/protobuf/proto:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/internal/identity.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package internal
-
-import netcontext "golang.org/x/net/context"
-
-// These functions are implementations of the wrapper functions
-// in ../appengine/identity.go. See that file for commentary.
-
-func AppID(c netcontext.Context) string {
-	return appID(FullyQualifiedAppID(c))
-}

vendor/google.golang.org/appengine/internal/identity_classic.go

-// Copyright 2015 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// +build appengine
-
-package internal
-
-import (
-	"appengine"
-
-	netcontext "golang.org/x/net/context"
-)
-
-func DefaultVersionHostname(ctx netcontext.Context) string {
-	return appengine.DefaultVersionHostname(fromContext(ctx))
-}
-
-func RequestID(ctx netcontext.Context) string  { return appengine.RequestID(fromContext(ctx)) }
-func Datacenter(_ netcontext.Context) string   { return appengine.Datacenter() }
-func ServerSoftware() string                   { return appengine.ServerSoftware() }
-func ModuleName(ctx netcontext.Context) string { return appengine.ModuleName(fromContext(ctx)) }
-func VersionID(ctx netcontext.Context) string  { return appengine.VersionID(fromContext(ctx)) }
-func InstanceID() string                       { return appengine.InstanceID() }
-func IsDevAppServer() bool                     { return appengine.IsDevAppServer() }
-
-func fullyQualifiedAppID(ctx netcontext.Context) string { return fromContext(ctx).FullyQualifiedAppID() }

vendor/google.golang.org/appengine/internal/identity_vm.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// +build !appengine
-
-package internal
-
-import (
-	"net/http"
-	"os"
-
-	netcontext "golang.org/x/net/context"
-)
-
-// These functions are implementations of the wrapper functions
-// in ../appengine/identity.go. See that file for commentary.
-
-const (
-	hDefaultVersionHostname = "X-AppEngine-Default-Version-Hostname"
-	hRequestLogId           = "X-AppEngine-Request-Log-Id"
-	hDatacenter             = "X-AppEngine-Datacenter"
-)
-
-func ctxHeaders(ctx netcontext.Context) http.Header {
-	return fromContext(ctx).Request().Header
-}
-
-func DefaultVersionHostname(ctx netcontext.Context) string {
-	return ctxHeaders(ctx).Get(hDefaultVersionHostname)
-}
-
-func RequestID(ctx netcontext.Context) string {
-	return ctxHeaders(ctx).Get(hRequestLogId)
-}
-
-func Datacenter(ctx netcontext.Context) string {
-	return ctxHeaders(ctx).Get(hDatacenter)
-}
-
-func ServerSoftware() string {
-	// TODO(dsymonds): Remove fallback when we've verified this.
-	if s := os.Getenv("SERVER_SOFTWARE"); s != "" {
-		return s
-	}
-	return "Google App Engine/1.x.x"
-}
-
-// TODO(dsymonds): Remove the metadata fetches.
-
-func ModuleName(_ netcontext.Context) string {
-	if s := os.Getenv("GAE_MODULE_NAME"); s != "" {
-		return s
-	}
-	return string(mustGetMetadata("instance/attributes/gae_backend_name"))
-}
-
-func VersionID(_ netcontext.Context) string {
-	if s1, s2 := os.Getenv("GAE_MODULE_VERSION"), os.Getenv("GAE_MINOR_VERSION"); s1 != "" && s2 != "" {
-		return s1 + "." + s2
-	}
-	return string(mustGetMetadata("instance/attributes/gae_backend_version")) + "." + string(mustGetMetadata("instance/attributes/gae_backend_minor_version"))
-}
-
-func InstanceID() string {
-	if s := os.Getenv("GAE_MODULE_INSTANCE"); s != "" {
-		return s
-	}
-	return string(mustGetMetadata("instance/attributes/gae_backend_instance"))
-}
-
-func partitionlessAppID() string {
-	// gae_project has everything except the partition prefix.
-	appID := os.Getenv("GAE_LONG_APP_ID")
-	if appID == "" {
-		appID = string(mustGetMetadata("instance/attributes/gae_project"))
-	}
-	return appID
-}
-
-func fullyQualifiedAppID(_ netcontext.Context) string {
-	appID := partitionlessAppID()
-
-	part := os.Getenv("GAE_PARTITION")
-	if part == "" {
-		part = string(mustGetMetadata("instance/attributes/gae_partition"))
-	}
-
-	if part != "" {
-		appID = part + "~" + appID
-	}
-	return appID
-}
-
-func IsDevAppServer() bool {
-	return os.Getenv("RUN_WITH_DEVAPPSERVER") != ""
-}

vendor/google.golang.org/appengine/internal/internal.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// Package internal provides support for package appengine.
-//
-// Programs should not use this package directly. Its API is not stable.
-// Use packages appengine and appengine/* instead.
-package internal
-
-import (
-	"fmt"
-
-	"github.com/golang/protobuf/proto"
-
-	remotepb "google.golang.org/appengine/internal/remote_api"
-)
-
-// errorCodeMaps is a map of service name to the error code map for the service.
-var errorCodeMaps = make(map[string]map[int32]string)
-
-// RegisterErrorCodeMap is called from API implementations to register their
-// error code map. This should only be called from init functions.
-func RegisterErrorCodeMap(service string, m map[int32]string) {
-	errorCodeMaps[service] = m
-}
-
-type timeoutCodeKey struct {
-	service string
-	code    int32
-}
-
-// timeoutCodes is the set of service+code pairs that represent timeouts.
-var timeoutCodes = make(map[timeoutCodeKey]bool)
-
-func RegisterTimeoutErrorCode(service string, code int32) {
-	timeoutCodes[timeoutCodeKey{service, code}] = true
-}
-
-// APIError is the type returned by appengine.Context's Call method
-// when an API call fails in an API-specific way. This may be, for instance,
-// a taskqueue API call failing with TaskQueueServiceError::UNKNOWN_QUEUE.
-type APIError struct {
-	Service string
-	Detail  string
-	Code    int32 // API-specific error code
-}
-
-func (e *APIError) Error() string {
-	if e.Code == 0 {
-		if e.Detail == "" {
-			return "APIError <empty>"
-		}
-		return e.Detail
-	}
-	s := fmt.Sprintf("API error %d", e.Code)
-	if m, ok := errorCodeMaps[e.Service]; ok {
-		s += " (" + e.Service + ": " + m[e.Code] + ")"
-	} else {
-		// Shouldn't happen, but provide a bit more detail if it does.
-		s = e.Service + " " + s
-	}
-	if e.Detail != "" {
-		s += ": " + e.Detail
-	}
-	return s
-}
-
-func (e *APIError) IsTimeout() bool {
-	return timeoutCodes[timeoutCodeKey{e.Service, e.Code}]
-}
-
-// CallError is the type returned by appengine.Context's Call method when an
-// API call fails in a generic way, such as RpcError::CAPABILITY_DISABLED.
-type CallError struct {
-	Detail string
-	Code   int32
-	// TODO: Remove this if we get a distinguishable error code.
-	Timeout bool
-}
-
-func (e *CallError) Error() string {
-	var msg string
-	switch remotepb.RpcError_ErrorCode(e.Code) {
-	case remotepb.RpcError_UNKNOWN:
-		return e.Detail
-	case remotepb.RpcError_OVER_QUOTA:
-		msg = "Over quota"
-	case remotepb.RpcError_CAPABILITY_DISABLED:
-		msg = "Capability disabled"
-	case remotepb.RpcError_CANCELLED:
-		msg = "Canceled"
-	default:
-		msg = fmt.Sprintf("Call error %d", e.Code)
-	}
-	s := msg + ": " + e.Detail
-	if e.Timeout {
-		s += " (timeout)"
-	}
-	return s
-}
-
-func (e *CallError) IsTimeout() bool {
-	return e.Timeout
-}
-
-// NamespaceMods is a map from API service to a function that will mutate an RPC request to attach a namespace.
-// The function should be prepared to be called on the same message more than once; it should only modify the
-// RPC request the first time.
-var NamespaceMods = make(map[string]func(m proto.Message, namespace string))

vendor/google.golang.org/appengine/internal/log/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["log_service.pb.go"],
-    tags = ["automanaged"],
-    deps = ["//vendor/github.com/golang/protobuf/proto:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/internal/log/log_service.proto

-syntax = "proto2";
-option go_package = "log";
-
-package appengine;
-
-message LogServiceError {
-  enum ErrorCode {
-    OK  = 0;
-    INVALID_REQUEST = 1;
-    STORAGE_ERROR = 2;
-  }
-}
-
-message UserAppLogLine {
-  required int64 timestamp_usec = 1;
-  required int64 level = 2;
-  required string message = 3;
-}
-
-message UserAppLogGroup {
-  repeated UserAppLogLine log_line = 2;
-}
-
-message FlushRequest {
-  optional bytes logs = 1;
-}
-
-message SetStatusRequest {
-  required string status = 1;
-}
-
-
-message LogOffset {
-  optional bytes request_id = 1;
-}
-
-message LogLine {
-  required int64 time = 1;
-  required int32 level = 2;
-  required string log_message = 3;
-}
-
-message RequestLog {
-  required string app_id = 1;
-  optional string module_id = 37 [default="default"];
-  required string version_id = 2;
-  required bytes request_id = 3;
-  optional LogOffset offset = 35;
-  required string ip = 4;
-  optional string nickname = 5;
-  required int64 start_time = 6;
-  required int64 end_time = 7;
-  required int64 latency = 8;
-  required int64 mcycles = 9;
-  required string method = 10;
-  required string resource = 11;
-  required string http_version = 12;
-  required int32 status = 13;
-  required int64 response_size = 14;
-  optional string referrer = 15;
-  optional string user_agent = 16;
-  required string url_map_entry = 17;
-  required string combined = 18;
-  optional int64 api_mcycles = 19;
-  optional string host = 20;
-  optional double cost = 21;
-
-  optional string task_queue_name = 22;
-  optional string task_name = 23;
-
-  optional bool was_loading_request = 24;
-  optional int64 pending_time = 25;
-  optional int32 replica_index = 26 [default = -1];
-  optional bool finished = 27 [default = true];
-  optional bytes clone_key = 28;
-
-  repeated LogLine line = 29;
-
-  optional bool lines_incomplete = 36;
-  optional bytes app_engine_release = 38;
-
-  optional int32 exit_reason = 30;
-  optional bool was_throttled_for_time = 31;
-  optional bool was_throttled_for_requests = 32;
-  optional int64 throttled_time = 33;
-
-  optional bytes server_name = 34;
-}
-
-message LogModuleVersion {
-  optional string module_id = 1 [default="default"];
-  optional string version_id = 2;
-}
-
-message LogReadRequest {
-  required string app_id = 1;
-  repeated string version_id = 2;
-  repeated LogModuleVersion module_version = 19;
-
-  optional int64 start_time = 3;
-  optional int64 end_time = 4;
-  optional LogOffset offset = 5;
-  repeated bytes request_id = 6;
-
-  optional int32 minimum_log_level = 7;
-  optional bool include_incomplete = 8;
-  optional int64 count = 9;
-
-  optional string combined_log_regex = 14;
-  optional string host_regex = 15;
-  optional int32 replica_index = 16;
-
-  optional bool include_app_logs = 10;
-  optional int32 app_logs_per_request = 17;
-  optional bool include_host = 11;
-  optional bool include_all = 12;
-  optional bool cache_iterator = 13;
-  optional int32 num_shards = 18;
-}
-
-message LogReadResponse {
-  repeated RequestLog log = 1;
-  optional LogOffset offset = 2;
-  optional int64 last_end_time = 3;
-}
-
-message LogUsageRecord {
-  optional string version_id = 1;
-  optional int32 start_time = 2;
-  optional int32 end_time = 3;
-  optional int64 count = 4;
-  optional int64 total_size = 5;
-  optional int32 records = 6;
-}
-
-message LogUsageRequest {
-  required string app_id = 1;
-  repeated string version_id = 2;
-  optional int32 start_time = 3;
-  optional int32 end_time = 4;
-  optional uint32 resolution_hours = 5 [default = 1];
-  optional bool combine_versions = 6;
-  optional int32 usage_version = 7;
-  optional bool versions_only = 8;
-}
-
-message LogUsageResponse {
-  repeated LogUsageRecord usage = 1;
-  optional LogUsageRecord summary = 2;
-}

vendor/google.golang.org/appengine/internal/main.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// +build appengine
-
-package internal
-
-import (
-	"appengine_internal"
-)
-
-func Main() {
-	appengine_internal.Main()
-}

vendor/google.golang.org/appengine/internal/main_vm.go

-// Copyright 2011 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-// +build !appengine
-
-package internal
-
-import (
-	"io"
-	"log"
-	"net/http"
-	"net/url"
-	"os"
-)
-
-func Main() {
-	installHealthChecker(http.DefaultServeMux)
-
-	port := "8080"
-	if s := os.Getenv("PORT"); s != "" {
-		port = s
-	}
-
-	if err := http.ListenAndServe(":"+port, http.HandlerFunc(handleHTTP)); err != nil {
-		log.Fatalf("http.ListenAndServe: %v", err)
-	}
-}
-
-func installHealthChecker(mux *http.ServeMux) {
-	// If no health check handler has been installed by this point, add a trivial one.
-	const healthPath = "/_ah/health"
-	hreq := &http.Request{
-		Method: "GET",
-		URL: &url.URL{
-			Path: healthPath,
-		},
-	}
-	if _, pat := mux.Handler(hreq); pat != healthPath {
-		mux.HandleFunc(healthPath, func(w http.ResponseWriter, r *http.Request) {
-			io.WriteString(w, "ok")
-		})
-	}
-}

vendor/google.golang.org/appengine/internal/metadata.go

-// Copyright 2014 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package internal
-
-// This file has code for accessing metadata.
-//
-// References:
-//	https://cloud.google.com/compute/docs/metadata
-
-import (
-	"fmt"
-	"io/ioutil"
-	"log"
-	"net/http"
-	"net/url"
-)
-
-const (
-	metadataHost = "metadata"
-	metadataPath = "/computeMetadata/v1/"
-)
-
-var (
-	metadataRequestHeaders = http.Header{
-		"Metadata-Flavor": []string{"Google"},
-	}
-)
-
-// TODO(dsymonds): Do we need to support default values, like Python?
-func mustGetMetadata(key string) []byte {
-	b, err := getMetadata(key)
-	if err != nil {
-		log.Fatalf("Metadata fetch failed: %v", err)
-	}
-	return b
-}
-
-func getMetadata(key string) ([]byte, error) {
-	// TODO(dsymonds): May need to use url.Parse to support keys with query args.
-	req := &http.Request{
-		Method: "GET",
-		URL: &url.URL{
-			Scheme: "http",
-			Host:   metadataHost,
-			Path:   metadataPath + key,
-		},
-		Header: metadataRequestHeaders,
-		Host:   metadataHost,
-	}
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 200 {
-		return nil, fmt.Errorf("metadata server returned HTTP %d", resp.StatusCode)
-	}
-	return ioutil.ReadAll(resp.Body)
-}

vendor/google.golang.org/appengine/internal/modules/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["modules_service.pb.go"],
-    tags = ["automanaged"],
-    deps = ["//vendor/github.com/golang/protobuf/proto:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/internal/modules/modules_service.proto

-syntax = "proto2";
-option go_package = "modules";
-
-package appengine;
-
-message ModulesServiceError {
-  enum ErrorCode {
-    OK  = 0;
-    INVALID_MODULE = 1;
-    INVALID_VERSION = 2;
-    INVALID_INSTANCES = 3;
-    TRANSIENT_ERROR = 4;
-    UNEXPECTED_STATE = 5;
-  }
-}
-
-message GetModulesRequest {
-}
-
-message GetModulesResponse {
-  repeated string module = 1;
-}
-
-message GetVersionsRequest {
-  optional string module = 1;
-}
-
-message GetVersionsResponse {
-  repeated string version = 1;
-}
-
-message GetDefaultVersionRequest {
-  optional string module = 1;
-}
-
-message GetDefaultVersionResponse {
-  required string version = 1;
-}
-
-message GetNumInstancesRequest {
-  optional string module = 1;
-  optional string version = 2;
-}
-
-message GetNumInstancesResponse {
-  required int64 instances = 1;
-}
-
-message SetNumInstancesRequest {
-  optional string module = 1;
-  optional string version = 2;
-  required int64 instances = 3;
-}
-
-message SetNumInstancesResponse {}
-
-message StartModuleRequest {
-  required string module = 1;
-  required string version = 2;
-}
-
-message StartModuleResponse {}
-
-message StopModuleRequest {
-  optional string module = 1;
-  optional string version = 2;
-}
-
-message StopModuleResponse {}
-
-message GetHostnameRequest {
-  optional string module = 1;
-  optional string version = 2;
-  optional string instance = 3;
-}
-
-message GetHostnameResponse {
-  required string hostname = 1;
-}
-

vendor/google.golang.org/appengine/internal/net.go

-// Copyright 2014 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package internal
-
-// This file implements a network dialer that limits the number of concurrent connections.
-// It is only used for API calls.
-
-import (
-	"log"
-	"net"
-	"runtime"
-	"sync"
-	"time"
-)
-
-var limitSem = make(chan int, 100) // TODO(dsymonds): Use environment variable.
-
-func limitRelease() {
-	// non-blocking
-	select {
-	case <-limitSem:
-	default:
-		// This should not normally happen.
-		log.Print("appengine: unbalanced limitSem release!")
-	}
-}
-
-func limitDial(network, addr string) (net.Conn, error) {
-	limitSem <- 1
-
-	// Dial with a timeout in case the API host is MIA.
-	// The connection should normally be very fast.
-	conn, err := net.DialTimeout(network, addr, 500*time.Millisecond)
-	if err != nil {
-		limitRelease()
-		return nil, err
-	}
-	lc := &limitConn{Conn: conn}
-	runtime.SetFinalizer(lc, (*limitConn).Close) // shouldn't usually be required
-	return lc, nil
-}
-
-type limitConn struct {
-	close sync.Once
-	net.Conn
-}
-
-func (lc *limitConn) Close() error {
-	defer lc.close.Do(func() {
-		limitRelease()
-		runtime.SetFinalizer(lc, nil)
-	})
-	return lc.Conn.Close()
-}

vendor/google.golang.org/appengine/internal/regen.sh

-#!/bin/bash -e
-#
-# This script rebuilds the generated code for the protocol buffers.
-# To run this you will need protoc and goprotobuf installed;
-# see https://github.com/golang/protobuf for instructions.
-
-PKG=google.golang.org/appengine
-
-function die() {
-	echo 1>&2 $*
-	exit 1
-}
-
-# Sanity check that the right tools are accessible.
-for tool in go protoc protoc-gen-go; do
-	q=$(which $tool) || die "didn't find $tool"
-	echo 1>&2 "$tool: $q"
-done
-
-echo -n 1>&2 "finding package dir... "
-pkgdir=$(go list -f '{{.Dir}}' $PKG)
-echo 1>&2 $pkgdir
-base=$(echo $pkgdir | sed "s,/$PKG\$,,")
-echo 1>&2 "base: $base"
-cd $base
-
-# Run protoc once per package.
-for dir in $(find $PKG/internal -name '*.proto' | xargs dirname | sort | uniq); do
-	echo 1>&2 "* $dir"
-	protoc --go_out=. $dir/*.proto
-done
-
-for f in $(find $PKG/internal -name '*.pb.go'); do
-  # Remove proto.RegisterEnum calls.
-  # These cause duplicate registration panics when these packages
-  # are used on classic App Engine. proto.RegisterEnum only affects
-  # parsing the text format; we don't care about that.
-  # https://code.google.com/p/googleappengine/issues/detail?id=11670#c17
-  sed -i '/proto.RegisterEnum/d' $f
-done

vendor/google.golang.org/appengine/internal/remote_api/BUILD

-package(default_visibility = ["//visibility:public"])
-
-licenses(["notice"])
-
-load(
-    "@io_bazel_rules_go//go:def.bzl",
-    "go_library",
-)
-
-go_library(
-    name = "go_default_library",
-    srcs = ["remote_api.pb.go"],
-    tags = ["automanaged"],
-    deps = ["//vendor/github.com/golang/protobuf/proto:go_default_library"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-)

vendor/google.golang.org/appengine/internal/remote_api/remote_api.pb.go

-// Code generated by protoc-gen-go.
-// source: google.golang.org/appengine/internal/remote_api/remote_api.proto
-// DO NOT EDIT!
-
-/*
-Package remote_api is a generated protocol buffer package.
-
-It is generated from these files:
-	google.golang.org/appengine/internal/remote_api/remote_api.proto
-
-It has these top-level messages:
-	Request
-	ApplicationError
-	RpcError
-	Response
-*/
-package remote_api
-
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-type RpcError_ErrorCode int32
-
-const (
-	RpcError_UNKNOWN             RpcError_ErrorCode = 0
-	RpcError_CALL_NOT_FOUND      RpcError_ErrorCode = 1
-	RpcError_PARSE_ERROR         RpcError_ErrorCode = 2
-	RpcError_SECURITY_VIOLATION  RpcError_ErrorCode = 3
-	RpcError_OVER_QUOTA          RpcError_ErrorCode = 4
-	RpcError_REQUEST_TOO_LARGE   RpcError_ErrorCode = 5
-	RpcError_CAPABILITY_DISABLED RpcError_ErrorCode = 6
-	RpcError_FEATURE_DISABLED    RpcError_ErrorCode = 7
-	RpcError_BAD_REQUEST         RpcError_ErrorCode = 8
-	RpcError_RESPONSE_TOO_LARGE  RpcError_ErrorCode = 9
-	RpcError_CANCELLED           RpcError_ErrorCode = 10
-	RpcError_REPLAY_ERROR        RpcError_ErrorCode = 11
-	RpcError_DEADLINE_EXCEEDED   RpcError_ErrorCode = 12
-)
-
-var RpcError_ErrorCode_name = map[int32]string{
-	0:  "UNKNOWN",
-	1:  "CALL_NOT_FOUND",
-	2:  "PARSE_ERROR",
-	3:  "SECURITY_VIOLATION",
-	4:  "OVER_QUOTA",
-	5:  "REQUEST_TOO_LARGE",
-	6:  "CAPABILITY_DISABLED",
-	7:  "FEATURE_DISABLED",
-	8:  "BAD_REQUEST",
-	9:  "RESPONSE_TOO_LARGE",
-	10: "CANCELLED",
-	11: "REPLAY_ERROR",
-	12: "DEADLINE_EXCEEDED",
-}
-var RpcError_ErrorCode_value = map[string]int32{
-	"UNKNOWN":             0,
-	"CALL_NOT_FOUND":      1,
-	"PARSE_ERROR":         2,
-	"SECURITY_VIOLATION":  3,
-	"OVER_QUOTA":          4,
-	"REQUEST_TOO_LARGE":   5,
-	"CAPABILITY_DISABLED": 6,
-	"FEATURE_DISABLED":    7,
-	"BAD_REQUEST":         8,
-	"RESPONSE_TOO_LARGE":  9,
-	"CANCELLED":           10,
-	"REPLAY_ERROR":        11,
-	"DEADLINE_EXCEEDED":   12,
-}
-
-func (x RpcError_ErrorCode) Enum() *RpcError_ErrorCode {
-	p := new(RpcError_ErrorCode)
-	*p = x
-	return p
-}
-func (x RpcError_ErrorCode) String() string {
-	return proto.EnumName(RpcError_ErrorCode_name, int32(x))
-}
-func (x *RpcError_ErrorCode) UnmarshalJSON(data []byte) error {
-	value, err := proto.UnmarshalJSONEnum(RpcError_ErrorCode_value, data, "RpcError_ErrorCode")
-	if err != nil {
-		return err
-	}
-	*x = RpcError_ErrorCode(value)
-	return nil
-}
-
-type Request struct {
-	ServiceName      *string `protobuf:"bytes,2,req,name=service_name" json:"service_name,omitempty"`
-	Method           *string `protobuf:"bytes,3,req,name=method" json:"method,omitempty"`
-	Request          []byte  `protobuf:"bytes,4,req,name=request" json:"request,omitempty"`
-	RequestId        *string `protobuf:"bytes,5,opt,name=request_id" json:"request_id,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *Request) Reset()         { *m = Request{} }
-func (m *Request) String() string { return proto.CompactTextString(m) }
-func (*Request) ProtoMessage()    {}
-
-func (m *Request) GetServiceName() string {
-	if m != nil && m.ServiceName != nil {
-		return *m.ServiceName
-	}
-	return ""
-}
-
-func (m *Request) GetMethod() string {
-	if m != nil && m.Method != nil {
-		return *m.Method
-	}
-	return ""
-}
-
-func (m *Request) GetRequest() []byte {
-	if m != nil {
-		return m.Request
-	}
-	return nil
-}
-
-func (m *Request) GetRequestId() string {
-	if m != nil && m.RequestId != nil {
-		return *m.RequestId
-	}
-	return ""
-}
-
-type ApplicationError struct {
-	Code             *int32  `protobuf:"varint,1,req,name=code" json:"code,omitempty"`
-	Detail           *string `protobuf:"bytes,2,req,name=detail" json:"detail,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *ApplicationError) Reset()         { *m = ApplicationError{} }
-func (m *ApplicationError) String() string { return proto.CompactTextString(m) }
-func (*ApplicationError) ProtoMessage()    {}
-
-func (m *ApplicationError) GetCode() int32 {
-	if m != nil && m.Code != nil {
-		return *m.Code
-	}
-	return 0
-}
-
-func (m *ApplicationError) GetDetail() string {
-	if m != nil && m.Detail != nil {
-		return *m.Detail
-	}
-	return ""
-}
-
-type RpcError struct {
-	Code             *int32  `protobuf:"varint,1,req,name=code" json:"code,omitempty"`
-	Detail           *string `protobuf:"bytes,2,opt,name=detail" json:"detail,omitempty"`
-	XXX_unrecognized []byte  `json:"-"`
-}
-
-func (m *RpcError) Reset()         { *m = RpcError{} }
-func (m *RpcError) String() string { return proto.CompactTextString(m) }
-func (*RpcError) ProtoMessage()    {}
-
-func (m *RpcError) GetCode() int32 {
-	if m != nil && m.Code != nil {
-		return *m.Code
-	}
-	return 0
-}
-
-func (m *RpcError) GetDetail() string {
-	if m != nil && m.Detail != nil {
-		return *m.Detail
-	}
-	return ""
-}
-
-type Response struct {
-	Response         []byte            `protobuf:"bytes,1,opt,name=response" json:"response,omitempty"`
-	Exception        []byte            `protobuf:"bytes,2,opt,name=exception" json:"exception,omitempty"`
-	ApplicationError *ApplicationError `protobuf:"bytes,3,opt,name=application_error" json:"application_error,omitempty"`
-	JavaException    []byte            `protobuf:"bytes,4,opt,name=java_exception" json:"java_exception,omitempty"`
-	RpcError         *RpcError         `protobuf:"bytes,5,opt,name=rpc_error" json:"rpc_error,omitempty"`
-	XXX_unrecognized []byte            `json:"-"`
-}
-
-func (m *Response) Reset()         { *m = Response{} }
-func (m *Response) String() string { return proto.CompactTextString(m) }
-func (*Response) ProtoMessage()    {}
-
-func (m *Response) GetResponse() []byte {
-	if m != nil {
-		return m.Response
-	}
-	return nil
-}
-
-func (m *Response) GetException() []byte {
-	if m != nil {
-		return m.Exception
-	}
-	return nil
-}
-
-func (m *Response) GetApplicationError() *ApplicationError {
-	if m != nil {
-		return m.ApplicationError
-	}
-	return nil
-}
-
-func (m *Response) GetJavaException() []byte {
-	if m != nil {
-		return m.JavaException
-	}
-	return nil
-}
-
-func (m *Response) GetRpcError() *RpcError {
-	if m != nil {
-		return m.RpcError
-	}
-	return nil
-}
-
-func init() {
-}

vendor/google.golang.org/appengine/internal/remote_api/remote_api.proto

-syntax = "proto2";
-option go_package = "remote_api";
-
-package remote_api;
-
-message Request {
-  required string service_name = 2;
-  required string method = 3;
-  required bytes request = 4;
-  optional string request_id = 5;
-}
-
-message ApplicationError {
-  required int32 code = 1;
-  required string detail = 2;
-}
-
-message RpcError {
-  enum ErrorCode {
-    UNKNOWN = 0;
-    CALL_NOT_FOUND = 1;
-    PARSE_ERROR = 2;
-    SECURITY_VIOLATION = 3;
-    OVER_QUOTA = 4;
-    REQUEST_TOO_LARGE = 5;
-    CAPABILITY_DISABLED = 6;
-    FEATURE_DISABLED = 7;
-    BAD_REQUEST = 8;
-    RESPONSE_TOO_LARGE = 9;
-    CANCELLED = 10;
-    REPLAY_ERROR = 11;
-    DEADLINE_EXCEEDED = 12;
-  }
-  required int32 code = 1;
-  optional string detail = 2;
-}
-
-message Response {
-  optional bytes response = 1;
-  optional bytes exception = 2;
-  optional ApplicationError application_error = 3;
-  optional bytes java_exception = 4;
-  optional RpcError rpc_error = 5;
-}

vendor/google.golang.org/appengine/internal/transaction.go

-// Copyright 2014 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package internal
-
-// This file implements hooks for applying datastore transactions.
-
-import (
-	"errors"
-	"reflect"
-
-	"github.com/golang/protobuf/proto"
-	netcontext "golang.org/x/net/context"
-
-	basepb "google.golang.org/appengine/internal/base"
-	pb "google.golang.org/appengine/internal/datastore"
-)
-
-var transactionSetters = make(map[reflect.Type]reflect.Value)
-
-// RegisterTransactionSetter registers a function that sets transaction information
-// in a protocol buffer message. f should be a function with two arguments,
-// the first being a protocol buffer type, and the second being *datastore.Transaction.
-func RegisterTransactionSetter(f interface{}) {
-	v := reflect.ValueOf(f)
-	transactionSetters[v.Type().In(0)] = v
-}
-
-// applyTransaction applies the transaction t to message pb
-// by using the relevant setter passed to RegisterTransactionSetter.
-func applyTransaction(pb proto.Message, t *pb.Transaction) {
-	v := reflect.ValueOf(pb)
-	if f, ok := transactionSetters[v.Type()]; ok {
-		f.Call([]reflect.Value{v, reflect.ValueOf(t)})
-	}
-}
-
-var transactionKey = "used for *Transaction"
-
-func transactionFromContext(ctx netcontext.Context) *transaction {
-	t, _ := ctx.Value(&transactionKey).(*transaction)
-	return t
-}
-
-func withTransaction(ctx netcontext.Context, t *transaction) netcontext.Context {
-	return netcontext.WithValue(ctx, &transactionKey, t)
-}
-
-type transaction struct {
-	transaction pb.Transaction
-	finished    bool
-}
-
-var ErrConcurrentTransaction = errors.New("internal: concurrent transaction")
-
-func RunTransactionOnce(c netcontext.Context, f func(netcontext.Context) error, xg bool) error {
-	if transactionFromContext(c) != nil {
-		return errors.New("nested transactions are not supported")
-	}
-
-	// Begin the transaction.
-	t := &transaction{}
-	req := &pb.BeginTransactionRequest{
-		App: proto.String(FullyQualifiedAppID(c)),
-	}
-	if xg {
-		req.AllowMultipleEg = proto.Bool(true)
-	}
-	if err := Call(c, "datastore_v3", "BeginTransaction", req, &t.transaction); err != nil {
-		return err
-	}
-
-	// Call f, rolling back the transaction if f returns a non-nil error, or panics.
-	// The panic is not recovered.
-	defer func() {
-		if t.finished {
-			return
-		}
-		t.finished = true
-		// Ignore the error return value, since we are already returning a non-nil
-		// error (or we're panicking).
-		Call(c, "datastore_v3", "Rollback", &t.transaction, &basepb.VoidProto{})
-	}()
-	if err := f(withTransaction(c, t)); err != nil {
-		return err
-	}
-	t.finished = true
-
-	// Commit the transaction.
-	res := &pb.CommitResponse{}
-	err := Call(c, "datastore_v3", "Commit", &t.transaction, res)
-	if ae, ok := err.(*APIError); ok {
-		/* TODO: restore this conditional
-		if appengine.IsDevAppServer() {
-		*/
-		// The Python Dev AppServer raises an ApplicationError with error code 2 (which is
-		// Error.CONCURRENT_TRANSACTION) and message "Concurrency exception.".
-		if ae.Code == int32(pb.Error_BAD_REQUEST) && ae.Detail == "ApplicationError: 2 Concurrency exception." {
-			return ErrConcurrentTransaction
-		}
-		if ae.Code == int32(pb.Error_CONCURRENT_TRANSACTION) {
-			return ErrConcurrentTransaction
-		}
-	}
-	return err
-}

vendor/google.golang.org/appengine/namespace.go

-// Copyright 2012 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package appengine
-
-import (
-	"fmt"
-	"regexp"
-
-	"golang.org/x/net/context"
-
-	"google.golang.org/appengine/internal"
-)
-
-// Namespace returns a replacement context that operates within the given namespace.
-func Namespace(c context.Context, namespace string) (context.Context, error) {
-	if !validNamespace.MatchString(namespace) {
-		return nil, fmt.Errorf("appengine: namespace %q does not match /%s/", namespace, validNamespace)
-	}
-	return internal.NamespacedContext(c, namespace), nil
-}
-
-// validNamespace matches valid namespace names.
-var validNamespace = regexp.MustCompile(`^[0-9A-Za-z._-]{0,100}$`)

vendor/google.golang.org/appengine/timeout.go

-// Copyright 2013 Google Inc. All rights reserved.
-// Use of this source code is governed by the Apache 2.0
-// license that can be found in the LICENSE file.
-
-package appengine
-
-import "golang.org/x/net/context"
-
-// IsTimeoutError reports whether err is a timeout error.
-func IsTimeoutError(err error) bool {
-	if err == context.DeadlineExceeded {
-		return true
-	}
-	if t, ok := err.(interface {
-		IsTimeout() bool
-	}); ok {
-		return t.IsTimeout()
-	}
-	return false
-}