feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/__init__.py

@@ -0,0 +1,14 @@
+"""Requests test package initialisation."""
+
+import warnings
+
+try:
+    from urllib3.exceptions import SNIMissingWarning
+
+    # urllib3 1.x sets SNIMissingWarning to only go off once,
+    # while this test suite requires it to always fire
+    # so that it occurs during test_requests.test_https_warnings
+    warnings.simplefilter("always", SNIMissingWarning)
+except ImportError:
+    # urllib3 2.0 removed that warning and errors out instead
+    SNIMissingWarning = None

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/README.md

@@ -0,0 +1,10 @@
+# Testing Certificates
+
+This is a collection of certificates useful for testing aspects of Requests'
+behaviour.
+
+The certificates include:
+
+* [expired](./expired) server certificate with a valid certificate authority
+* [mtls](./mtls) provides a valid client certificate with a 2 year validity
+* [valid](./valid) has a valid server certificate

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/Makefile

@@ -0,0 +1,13 @@
+.PHONY: all clean ca server
+
+ca:
+	make -C $@ all
+
+server:
+	make -C $@ all
+
+all: ca server
+
+clean:
+	make -C ca clean
+	make -C server clean

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/README.md

@@ -0,0 +1,11 @@
+# Expired Certificates and Configuration for Testing
+
+This has a valid certificate authority in [ca](./ca) and an invalid server
+certificate in [server](./server).
+
+This can all be regenerated with:
+
+```
+make clean
+make all
+```

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/ca/Makefile

@@ -0,0 +1,13 @@
+.PHONY: all clean
+
+root_files = ca-private.key ca.crt
+
+ca-private.key:
+	openssl genrsa -out ca-private.key 2048
+
+all: ca-private.key
+	openssl req -x509 -sha256 -days 7300 -key ca-private.key -out ca.crt -config ca.cnf
+	ln -s ca.crt cacert.pem
+
+clean:
+	rm -f cacert.pem ca.crt ca-private.key *.csr

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/ca/ca-private.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDHlIhe7GLCeSk8
+RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He
+mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK
+na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6
+fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm
+zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy
+e6lzFyWnAgMBAAECggEAFwzHhzcD3PQDWCus85PwZoxTeQ817BmUBGpBBOKM0gLG
+GCsT7XsmGP2NjICBy9OK+QTKawmb/wR5XK0OMUWDHXqtWn+NFIyojyo8+HEeCf8n
+4ZleTFHLnJ+d2N1etbc2qc9mY3tjpaurq8/0Tol9YH06ock1TY2+lO+a5HvMURnY
+hcWs70CamL+5B/6n67DhjzMtIW3dIXuEEceM1BW/jW8SKq0JHpQ3t+OJwID7zFaJ
+bLyOwAVheMzVGvN3yphf8tll3tMA65bNjdOzgOfZSjAy7EGjW3DyAolDw9jKLRyu
+E0gw/exNGe618oMIeUDv0KParlL4RjdiUP8l0xYOwQKBgQD3eYj9rWeqZquI9vKP
+gaSv6urb2UJLngShZUpEZRNJgBO+Ewiof0w8tpQdsnuMvWudxMLbzgiUNA+NyC/K
+CpzIXFkWnWx+A/pxs8ZO8moOfajVRayJgeOLsQZb7c4fXGsVGApbN4+cPNhTNG6d
+ucErv6tae/SzAzcLc5Vkw/ELxwKBgQDOdJ5Wl5JeKAvU/3kF6+MYWCrXxZqMjoHS
+y1BtyMX5RbdaWTCfDUu1aV3qJOJjjWQ9DJdJQcEsrTjOpD4bVdZx4w/XEG0JXAa3
+jRypVHGdeG/TjhUGJA8U+KX3a1DkcdqM9pqFYRw5Ie95Wz9YRroI+YkixqpK8d7W
+C+5BodxXIQKBgCk8Lv9V7XgPM3XW8APJbk+BrTCEuu8unUbnQcCztssAdEmvkjnB
+PErBgVyRaNTCmzPmnTFS20sWgaD2QkBAFG+uM4n5ISK+NvTLJ7fv3IwdlAw1V9Jx
+uiCElrKqpTXEiHMzVkZss5ks6j6y9duCIBXSEhM5pERPvNRDphjsLTXxAoGARSNC
+nyb1Kjjo9XR0V+pNy6pC9q1C+00B5tCVZ55zxe114Hi70pfGQcM+YxnlAoeoCNW9
+mBfAFDESNAlGjyrovIzYkiH7EcZSrYdBEOepgJ2DfWo4Wi0bK9+03K2AknAaS1iO
+GJqTtAJMSuymwu40gKroJNA42Q40nKO0LyCARGECgYEAiFRHkblBtStv22SpZxNC
+jim9yuM0ikh7Ij1lEHysc/GWb2RQNxQVk54BU2kQ0d9xwMZQTKvpF3VE9t7uGdwt
+AasWPr/tWYt35Ud0D4bNlagJJ4Xdslf8n1nkq3qqqDQbd7kkQRgwGzVr0uVg7ZfS
+26qSPQ0/aF9nagb5eHX3AuU=
+-----END PRIVATE KEY-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/ca/ca.cnf

@@ -0,0 +1,12 @@
+[req]
+default_bits = 2048
+prompt = no
+default_md = sha256
+encrypt_key = no
+distinguished_name = dn
+
+[dn]
+C = US                            # country code
+O = Python Software Foundation    # organization
+OU = python-requests              # organization unit/department
+CN = Self-Signed Root CA          # common name / your cert name

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/ca/ca.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox
+CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv
+bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l
+ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG
+A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw
+FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv
+b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8
+RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He
+mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK
+na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6
+fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm
+zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy
+e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV
+GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws
+Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn
+9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ
+rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ
+6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg=
+-----END CERTIFICATE-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/ca/ca.srl

@@ -0,0 +1 @@
+4F36C3A7E075BA6452D10EEB81E7F189FF489B74

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/server/Makefile

@@ -0,0 +1,16 @@
+.PHONY: all clean
+
+server.key:
+	openssl genrsa -out $@ 2048
+
+server.csr: server.key
+	openssl req -key $< -new -out $@ -config cert.cnf
+
+server.pem: server.csr
+	openssl x509 -req -CA ../ca/ca.crt -CAkey ../ca/ca-private.key -in server.csr -outform PEM -out server.pem -days 0 -CAcreateserial
+	openssl x509 -in ../ca/ca.crt -outform PEM >> $@
+
+all: server.pem
+
+clean:
+	rm -f server.*

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/server/cert.cnf

@@ -0,0 +1,24 @@
+[req]
+req_extensions = v3_req
+distinguished_name = req_distinguished_name
+prompt=no
+
+[req_distinguished_name]
+C = US
+ST = DE
+O = Python Software Foundation
+OU = python-requests
+CN = localhost
+
+[v3_req]
+# Extensions to add to a certificate request
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = *.localhost
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/server/server.csr

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDHjCCAgYCAQAwbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK
+DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl
+cXVlc3RzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQCKulIMpo633iCgbkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9
+kvPt//imqtl8FhuhKqJ8FCGrVl2YIGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoA
+IPyXytIR7VH9+ch9DFInJaoA/BekMuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh
+9VjvtuRDji2iOZpznlVE2PEN80bojArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4e
+ja7ad3R9G0kB1FzNj36jrNO5WtxHO/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspP
+IltfwOQh8qq2Q2AaMHNcVjMH3gHCZADfhk/zAgMBAAGgbDBqBgkqhkiG9w0BCQ4x
+XTBbMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMB
+MCwGA1UdEQQlMCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATAN
+BgkqhkiG9w0BAQsFAAOCAQEAfAhEhrulsZae71YFqgvzwJHm/hzXh47hErtgDXVJ
+mFqAxgF6XrnzYujlt3XQXUx/8vdrU7jH+Pe8WO1rDvFwRPMDGoBF3RX29SzyX/2F
+e102egnoRR+Hlf0Ixqu0CuTjEVnD+g4mRgXhV7LPKP4W6qGwzcVbaJ3c/zRcfqNR
+g9gN6Q6Qt4fXDc7wlx2T3nOszBLQ2XCsIyzVtOJ2sSuadqKH9Aj+mrkrLBdzVFHD
+FHnTMJ0t0+anZwd+AWDNsCr5lIwBGL634zw7/yJepMHuPFd2X24S3u8EaWPkfVQn
+lV6rLQMGjXYTe2xuYzlUCUYnKvkyPTMjSXDkxWa+WSNwyQ==
+-----END CERTIFICATE REQUEST-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/server/server.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCKulIMpo633iCg
+bkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9kvPt//imqtl8FhuhKqJ8FCGrVl2Y
+IGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoAIPyXytIR7VH9+ch9DFInJaoA/Bek
+MuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh9VjvtuRDji2iOZpznlVE2PEN80bo
+jArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4eja7ad3R9G0kB1FzNj36jrNO5WtxH
+O/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspPIltfwOQh8qq2Q2AaMHNcVjMH3gHC
+ZADfhk/zAgMBAAECggEAFSF9RvUFzyb0BEvXN44+/QaKv+4tkMmSW4Xs3rFnZ4G3
+E8nkpLUCF9ICD2z9tKNvcPScDFdKq5z7o6ToJ9faf5MRIdrBz8UlGLIO6g6l1Bjw
+vjNwJE3h+8MGjXl/IDbwXW/HgbQAeabsePPRSJRdvz2+ACn1M8VLdrLvFJA93ayW
++n3Bk0bXdsrzqBGdoDiNzmIHI3WqdONiR9TymuJe41NJtMKxQDF+c6Y1n/X1OtBk
+s9L+u9Xr+R3H72xSYrf1KH1mFZJfTnIPoOmdEU2tVZnZj03rZhT7p8R1fVNX6OHu
+NX1Dy9VA6J7dbcqdPvTI743ByQeb+hNnqI/3hmV5eQKBgQC++1Wn3v/dxtczjA+I
+tN4a7zyjhazpB25lde55HVfCQPxmYxIYct+j6S0JkMaoLrjiEDb4pnu4Gt4MDqZa
+r0Xm8t3wD1YKUUbhpBEGvsMhAEZEIsBOcwkTiEwsoF0mKFa2mTyqAImgIQa8uFt8
+Y/oTj55XFe1x6pZKEJRg+K+QSwKBgQC59ONVkMSBirLGS+G+b2kqiBdwZB/3s3wr
+feS1xTa+deL3AChnKT9+MsVqOkxdE2TRj/mAeF+5Woa5bPMvgr9Kl7u8bulTH80l
+YA/N6FneO11/ncnkgK9wN54kd5TiOtGsGB5S5t/nEAIMUIwWrM/cRau72xNEWOhT
+Tvw7TOSF+QKBgQCa/texeiYmE24sA4vH4yIuseKAw8hlBwbtiRyVZt8GZD9zyQuy
+k+g02tUWYk0XyXN65LX4bwURkZyMJIeWKZGNsaW1YnzturDQB5tZ4g/zBIoCWkHA
+aVQAaimIPk3a3foiD5NQVUdckfEp0GVPOsSGg5R6EO23+i8mxPXnDW1OqQKBgGvf
+lelTO8tyLFdAOcqBUt6rZ/1499p3snaAZ6bSqvk95dYnr0h48y5AQaln/FiaIYg4
+HyLZsZ4S18jFXSWYkWOyNeQP6yafciBWY5StT0TN52VaoX3+8McGXKUHAcVjHbLZ
+ou2wpP6jmKyQJVQaF9LOT9uAMOMbOFrrnQLBjmfxAoGAQAnUhMFG5mwi9Otxt6Mz
+g+Gr+3JTlzwC3L7UwGdlFc3G2vSdGx/yOrfzpxPImfIBS95mibDfdvEBMer26pvw
+a/ycqybyX9d/5nPDIaJ1lc4M4cbHC/cB52JI6avr/1g8OMK7lR7b/FsPVHS1w8kl
+n6uwEjVt2+gP2o9DFTGs158=
+-----END PRIVATE KEY-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/expired/server/server.pem

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIDXjCCAkYCFE82w6fgdbpkUtEO64Hn8Yn/SJt0MA0GCSqGSIb3DQEBCwUAMGox
+CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv
+bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l
+ZCBSb290IENBMB4XDTI0MDMxMzIxMTQ0NVoXDTI0MDMxMzIxMTQ0NVowbTELMAkG
+A1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUg
+Rm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRIwEAYDVQQDDAls
+b2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCKulIMpo63
+3iCgbkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9kvPt//imqtl8FhuhKqJ8FCGr
+Vl2YIGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoAIPyXytIR7VH9+ch9DFInJaoA
+/BekMuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh9VjvtuRDji2iOZpznlVE2PEN
+80bojArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4eja7ad3R9G0kB1FzNj36jrNO5
+WtxHO/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspPIltfwOQh8qq2Q2AaMHNcVjMH
+3gHCZADfhk/zAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGeQdB4+iDbJ78eKhCMV
+49Cm8nyYi9215rRRJ24Bw6BtVw1ECwymxLVOEB0gHCu8kKdsFnniFBtChts/ilFg
+blIyPKTsb3+kQW9YV9QwVdFdC4mTIljujCSQ4HNUC/Vjfnz85SDKf9/3PMKRr36+
+GtSLIozudPvkNmCv68jy3RRXyCwWHc43BLMSZKPD/W+DEuXShI9OIpIlSLBx16Hz
+4ce3/1pGuITWcsw6UcRqW31oPR31QmNs5fsq5ZCojDNFzEFCA1t9LiR6UOftFUKy
+yOZWfZeAGGdK75U+XDqS9Xkr5/ic5jE0I5rT7e7r3lpvQdgIj8lSx493fczLOGHr
+YA0=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox
+CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv
+bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l
+ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG
+A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw
+FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv
+b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8
+RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He
+mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK
+na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6
+fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm
+zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy
+e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV
+GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws
+Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn
+9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ
+rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ
+6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg=
+-----END CERTIFICATE-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/Makefile

@@ -0,0 +1,7 @@
+.PHONY: all clean
+
+all:
+	make -C client all
+
+clean:
+	make -C client clean

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/README.md

@@ -0,0 +1,4 @@
+# Certificate Examples for mTLS
+
+This has some generated certificates for mTLS utilization. The idea is to be
+able to have testing around how Requests handles client certificates.

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/client/Makefile

@@ -0,0 +1,16 @@
+.PHONY: all clean
+
+client.key:
+	openssl genrsa -out $@ 2048
+
+client.csr: client.key
+	openssl req -key $< -new -out $@ -config cert.cnf
+
+client.pem: client.csr
+	openssl x509 -req -CA ./ca/ca.crt -CAkey ./ca/ca-private.key -in client.csr -outform PEM -out client.pem -days 730 -CAcreateserial
+	openssl x509 -in ./ca/ca.crt -outform PEM >> $@
+
+all: client.pem
+
+clean:
+	rm -f client.*

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/client/ca

@@ -0,0 +1 @@
+../../expired/ca

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/client/cert.cnf

@@ -0,0 +1,26 @@
+[req]
+req_extensions = v3_req
+distinguished_name = req_distinguished_name
+prompt=no
+
+[req_distinguished_name]
+C = US
+ST = DE
+O = Python Software Foundation
+OU = python-requests
+CN = requests
+
+[v3_req]
+# Extensions to add to a certificate request
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = clientAuth
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = *.localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1
+URI.1 = spiffe://trust.python.org/v0/maintainer/sigmavirus24/project/requests/org/psf
+URI.2 = spiffe://trust.python.org/v1/maintainer:sigmavirus24/project:requests/org:psf
+URI.3 = spiffe://trust.python.org/v1/maintainer=sigmavirus24/project=requests/org=psf

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/client/client.csr

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIEGjCCAwICAQAwbDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK
+DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl
+cXVlc3RzMREwDwYDVQQDDAhyZXF1ZXN0czCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMn3iQycTjUzpKJChRNkcm33UB282cUwpxeqKN4ahHxBpS09HRhk
+cQYO7yErEUQwzQnBQEcIpzzeIMZIqHuCkgnySjeEJd95AIzNzGyoLLkS51TcJwgR
+v83AvT8ljA88s9h38qGTy4/TCxJgf76pfHIuC1qoKVQh3AuHj9nOxIZLUsrdDbWF
+WoLqKSVyTby+RXvSAppAR+cuBCaWStQ6xFORn48RHfc6t30ggD4rDAjyU6Vz6oR8
+ot3XmGdK0h42UdqidUWkRJajEbpkCnQSXS21IvfXKxF5sFqAXJrj9iVbUfpNPpaa
+W8IrHByngyV8amazGZrASstUVRFtWrnrcWECAwEAAaCCAWcwggFjBgkqhkiG9w0B
+CQ4xggFUMIIBUDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggr
+BgEFBQcDAjCCAR8GA1UdEQSCARYwggESggsqLmxvY2FsaG9zdIcEfwAAAYcQAAAA
+AAAAAAAAAAAAAAAAAYZNc3BpZmZlOi8vdHJ1c3QucHl0aG9uLm9yZy92MC9tYWlu
+dGFpbmVyL3NpZ21hdmlydXMyNC9wcm9qZWN0L3JlcXVlc3RzL29yZy9wc2aGTXNw
+aWZmZTovL3RydXN0LnB5dGhvbi5vcmcvdjEvbWFpbnRhaW5lcjpzaWdtYXZpcnVz
+MjQvcHJvamVjdDpyZXF1ZXN0cy9vcmc6cHNmhk1zcGlmZmU6Ly90cnVzdC5weXRo
+b24ub3JnL3YxL21haW50YWluZXI9c2lnbWF2aXJ1czI0L3Byb2plY3Q9cmVxdWVz
+dHMvb3JnPXBzZjANBgkqhkiG9w0BAQsFAAOCAQEAwP1KJ+Evddn2RV1FM6BFkoDK
+MPDO9qwb8ea3j57SIJXZlpw168DljmuGzxJw9oys2O6FYcspbHIocAkfFwiYgVAr
+NEog6xlCdPxNBJgC3YFIKwnmBjMPG6ZCWiJn940qTbaJ/j6ZviN17uW4K7Sl+THp
+IkMv29uQTWkfg+GbZ9q1hm2m2GHhYLGLAUdJdtv7JI+yq5uxdsWaCANpH6kc8SnK
+2rik6D3iItDhHCmToHBpdEnP8J+KDzf5pJrv/g3WH8XVrl4ZzBsOhmciWF4C3Hbf
+9eu8eAsp1AsIrZOEGTfClBd7vFCES5DmI0/iRs4czQooqZPnHjOw3Azp/LujrA==
+-----END CERTIFICATE REQUEST-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/client/client.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDJ94kMnE41M6Si
+QoUTZHJt91AdvNnFMKcXqijeGoR8QaUtPR0YZHEGDu8hKxFEMM0JwUBHCKc83iDG
+SKh7gpIJ8ko3hCXfeQCMzcxsqCy5EudU3CcIEb/NwL0/JYwPPLPYd/Khk8uP0wsS
+YH++qXxyLgtaqClUIdwLh4/ZzsSGS1LK3Q21hVqC6iklck28vkV70gKaQEfnLgQm
+lkrUOsRTkZ+PER33Ord9IIA+KwwI8lOlc+qEfKLd15hnStIeNlHaonVFpESWoxG6
+ZAp0El0ttSL31ysRebBagFya4/YlW1H6TT6WmlvCKxwcp4MlfGpmsxmawErLVFUR
+bVq563FhAgMBAAECggEABhWX97JJxN6JFNOjhgGzqiPA3R8lrFlv3zhNbODS9u9U
+q404xYBZIKaYhkucLzgNJUBrevhZbsL+V8WJQIH0JlU57nw5ATIjAHA+uqiXraen
+zRhTcLHK28b1AeRUA4LU+YN7jWnnawN075kf9WgjtfOJ0gcDimOkE7uCFjyyvPJA
+LG9bG+8enGjvUleKXNgmwP4Sq/GlEdGz9Qy+8ga3mtfAULUWe8haFNZXK8CN3xPp
+wmVqy7QzgH2TGN1p6Dyxib9ksSN/lOg0dShL8zgu+QXDNx2VwmVrI8Vr02vmB//0
+bYxCo5pfICPIFLjLl5yo30dvrUfYqF29PperStHGlQKBgQD/TdemlLjJNP0fvSs7
+KEVJj/22YuHK+wurNr2ZFbSdcF3v9sfiwysllmEyGr5cNYA56uUbfG+8VSw7kDll
+G+6BKK2UdlPH++6RahqWLqo4k6rsNrkq7elj8xG4gIjR5qzu2uLpjNwp2BGmIoUI
+eb1NcLfTlMcNCooV8RHjm1Z5WwKBgQDKhHkUPDcJm2/9Ltq2NZQMrCS7o4LV2uAI
+GhGpISfY+SfHkQQNZ9Fvbe6hrFeZs31nAvlTDpPEg/LGSVKA5I2EZT9gwzAQU1TD
+Cyol4xqqWFWlwze7w+RLYqX5LtXf7NJg2m5p+ZOoOzzqvTVpodDxqTlCNp2/6ICP
+vAIvWhbA8wKBgAYlr62ZIyHlHrsm6OWRwKlWyDseAmXKyasjtEj9Vs37qKdgf8ub
++2v6RPjZ3/+EYkQCveV9h4s3WctNW7Rtib6eZh+PAdFs5X+m2GEJWpvmIlVxs9+u
+vtHjRmf04FZ9gWh26MPK2no/c51Wc3GSzNYSgrqbeHd963k/xrh+QwTFAoGAZZjb
+3UjwG4O9RPjyhCKQ6WKa8v9urbamWaoqXfziLrmgOUAJFmiU6x/tbXI2aEdhjAIz
+7nULsLS5YLx8BWmjjV3106dYP3hut4KsXGF4iSjTnts25J27tA4DUeUrKrF2QVyT
+s9qfNvCw+Np/J0Uku3e33/3iWdpcVL9vIS5C5/0CgYBEuxb3dffNRqEiNkpOUrCD
+mQTqbO3X+hin9zT3GrxQE+7KpfCfdDIqdK6c5UWHirR3HUjUPZmIFLSx8msfLl3k
+hgQw37NMV+asg0Wy3P908qbtnEA2P6aDOMQeHJoC7qEHIDOcOQ1KP3FMvOrdscwS
+f0IIDygTH6fYr329s0iXjg==
+-----END PRIVATE KEY-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/mtls/client/client.pem

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIDXTCCAkUCFE82w6fgdbpkUtEO64Hn8Yn/SJtzMA0GCSqGSIb3DQEBCwUAMGox
+CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv
+bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l
+ZCBSb290IENBMB4XDTI0MDMxMzE4MzUwNFoXDTI2MDMxMzE4MzUwNFowbDELMAkG
+A1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUg
+Rm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMREwDwYDVQQDDAhy
+ZXF1ZXN0czCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMn3iQycTjUz
+pKJChRNkcm33UB282cUwpxeqKN4ahHxBpS09HRhkcQYO7yErEUQwzQnBQEcIpzze
+IMZIqHuCkgnySjeEJd95AIzNzGyoLLkS51TcJwgRv83AvT8ljA88s9h38qGTy4/T
+CxJgf76pfHIuC1qoKVQh3AuHj9nOxIZLUsrdDbWFWoLqKSVyTby+RXvSAppAR+cu
+BCaWStQ6xFORn48RHfc6t30ggD4rDAjyU6Vz6oR8ot3XmGdK0h42UdqidUWkRJaj
+EbpkCnQSXS21IvfXKxF5sFqAXJrj9iVbUfpNPpaaW8IrHByngyV8amazGZrASstU
+VRFtWrnrcWECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAHHgMckLDRV72p1FEVmCh
+AAPZjCswiPZFrwGPN57JqSWjoRB9ilKvo87aPosEO7vfa05OD/qkM/T9Qykuhati
+I1T1T7qX4Ymb5kTJIBouuflAO3uKVaq+ga2Q/HLlU5w/VoMU4RuK7+RaiRUEE3xL
+iPSMBvZpoMj695LnzcGrT5oLkFI0bTIlpQt1SFjDpHFtOj/ZdwgSbZYLoTCBXQK3
+7Y29qAj/XwEiCH63n8tJKvZcD8/ssMIMIdWhNmu+0jOWica/3WSih9Geoy6Ydtxi
+I5t9vRjC4LIipMUAF86AJIfvHJyI6aCNT420LaR6NRW0FQn5CPTHPAsKg3JkAywn
+Ew==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox
+CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv
+bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l
+ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG
+A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw
+FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv
+b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8
+RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He
+mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK
+na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6
+fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm
+zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy
+e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV
+GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws
+Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn
+9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ
+rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ
+6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg=
+-----END CERTIFICATE-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/valid/ca

@@ -0,0 +1 @@
+../expired/ca

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/valid/server/Makefile

@@ -0,0 +1,16 @@
+.PHONY: all clean
+
+server.key:
+	openssl genrsa -out $@ 2048
+
+server.csr: server.key
+	openssl req -key $< -config cert.cnf -new -out $@
+
+server.pem: server.csr
+	openssl x509 -req -CA ../ca/ca.crt -CAkey ../ca/ca-private.key -in server.csr -outform PEM -out server.pem -extfile cert.cnf -extensions v3_ca -days 7200 -CAcreateserial
+	openssl x509 -in ../ca/ca.crt -outform PEM >> $@
+
+all: server.pem
+
+clean:
+	rm -f server.*

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/valid/server/cert.cnf

@@ -0,0 +1,31 @@
+[req]
+req_extensions = v3_req
+distinguished_name = req_distinguished_name
+prompt=no
+
+[req_distinguished_name]
+C = US
+ST = DE
+O = Python Software Foundation
+OU = python-requests
+CN = localhost
+
+[v3_req]
+# Extensions to add to a certificate request
+basicConstraints = critical, CA:FALSE
+keyUsage = critical, digitalSignature, keyEncipherment
+extendedKeyUsage = critical, serverAuth
+subjectAltName = critical, @alt_names
+
+[v3_ca]
+# Extensions to add to a certificate request
+basicConstraints = critical, CA:FALSE
+keyUsage = critical, digitalSignature, keyEncipherment
+extendedKeyUsage = critical, serverAuth
+subjectAltName = critical, @alt_names
+
+[alt_names]
+DNS.1 = *.localhost
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/valid/server/server.csr

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIDKjCCAhICAQAwbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK
+DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl
+cXVlc3RzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQChEKOx377ymuDg23By5Re1DHi2RiBKSHr85/ZTZuwP/69lHN7q
+TQEO//EMEFZ9+ZwezeJJsejjP2HO5lQZbcsWok3hbM0wVT+vApkogPvJ8WNFFWFe
+ZBnGLi/1WM9cSZpUsDJ0XCsG0RTtO27wfgZQlKQMZxTkfi971oPYxNVSjTm2JcLT
+kvwYIwxjJXPDTOgRo9TEAY3cWkCrBJN4w74GWBTM5KDDA230T7WwLuv81XD2LvYj
+YYdMBGcxPr5tYTIlp3LncbcrDRNk3pbYQk0bRJgkw2vUkteiRGjkt+dgVnLc6+MI
+W+VLXEpj+zsOZ5/R4d1pofqj9sDyDPhtNr1JAgMBAAGgeDB2BgkqhkiG9w0BCQ4x
+aTBnMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBYGA1UdJQEB/wQMMAoG
+CCsGAQUFBwMBMC8GA1UdEQEB/wQlMCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAA
+AAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAQEAFTlFTn5Mn8JXtqB5bGjuiChe
+ClA6Y32Co4l7N0CtAlf+bExwLdpLOleTX3WnryIPALl9uBUI/67dy/STn/J1Yn86
+jWPEFwpmYNSKgQljYWcwtBdYLWfIsJO11kKdaAkOUHBEN5DKrXJ46Vs4918bD1/Q
+6ztqdrThiKc646u9xB58Hg7F0IyMWbHfs0x16ZpcN9otrIkbqOE2wzTmc65O1t1i
+HDljcSk7OnNy3a9wtLEnyPiyMqHf2k/bTlmiDRVe3cSy9xieoqmzHTnOCSASe1y9
+7lcEBQild18Jo4nACV4vCYOUwrMi/58LWW+lD6OmMnPiWUqOvMbgMffMNDpWPA==
+-----END CERTIFICATE REQUEST-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/valid/server/server.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQChEKOx377ymuDg
+23By5Re1DHi2RiBKSHr85/ZTZuwP/69lHN7qTQEO//EMEFZ9+ZwezeJJsejjP2HO
+5lQZbcsWok3hbM0wVT+vApkogPvJ8WNFFWFeZBnGLi/1WM9cSZpUsDJ0XCsG0RTt
+O27wfgZQlKQMZxTkfi971oPYxNVSjTm2JcLTkvwYIwxjJXPDTOgRo9TEAY3cWkCr
+BJN4w74GWBTM5KDDA230T7WwLuv81XD2LvYjYYdMBGcxPr5tYTIlp3LncbcrDRNk
+3pbYQk0bRJgkw2vUkteiRGjkt+dgVnLc6+MIW+VLXEpj+zsOZ5/R4d1pofqj9sDy
+DPhtNr1JAgMBAAECggEAIuLzBfXgCvXzlBjL2kMXd7p4EgkN+PEKnKmUr/t40b1Q
+zR6sBQWBX3GeET4fseElSQHQzCQaPNCve4xltm1S4jftFREHP7sTVHHEYWLQxuy/
+Uwkewj5927CI6ERgg82YfVP91bjaA/u5I+pt7O7rKLyNbPdN7fEMEW+FNuhpiVvg
+JMrcK1BCFL6pmIT21LyTwkacMKZSPko58pWE24MA9aSCHk6cXdwQWQK0AfQT3XGT
+C4I0hRed7LgqMH+gMuhpakiO13t8yTwxt2iQC9+aa4oSHD3BOi/CwIWfe1mHwmlr
+cj4Kof1JSnK4SVTD16T++PlnWZkF6oaLUNg+/c2C9QKBgQDOFSYIY7+HzinT2hbI
+yTIJCHpp+Iee+WVvvxjdZIPMDINrlIiHcMfXb0itUdcUO6tz0KYDMDLRC9CSP0ar
+6mBWUTHfAKF2S4JpI9JYI4PNtIpOP1NiYuyJlnh5+ytU1yIeIvl39hmLcRwI9mgz
+njy/D7yEoDCrG1dhcltubKpNXQKBgQDIFAVg0A7MNcxBZDLlk1NAME2JKOSszX8E
+VNucvZD+9l+L9V9BmwwPQdzYifv/dNp3nYn+lxRPPgze3ZWu4+PeDuGudxu0I6ll
+beFdbIcp1wbeQguzHYLjBYJqsMb4Pao5HPInjPu/HWfZlg9oZpJbKVucQwbonJLX
+lgca9KaE3QKBgA+OUx+g/+0tZ8ThGoUvgsJhzHPBWeNrKfgEcckMdFJrw2PUg3XN
+0pf1g4PpwJV7Z5bHcjCda8iR3r2bXydM+tapLF2L+6QlUQPEu3UBwUo+zY3Yg9/S
+Xc6I+DEk/4FY9+9UboZaolT/RcF7cCQtVqKJeo58VRAlcTQe4L32H+jVAoGALXX3
+Ht9HbXkP1w/YTLej4+LVy0OCag0rPiW13LBqALSkUx3GrhZ3sAPMFVuM6ad4eFNQ
+ZouXbsXvkLgSabGYNf11o/mmTtEHjWdhHKQrNgOIqPmixOkAs2quDmXqX79LLTz5
+fKkZDny0+wiQqa0cth/4k9HbAQGKj/ej16kdKPUCgYAz08Y39NnJYxRNz3tu/7C6
+jKyXKxhuZCZCt3cSWto5Tg0mVVB+2Jk2GhG1hCfZoRCP25R3FFBR1HOJgOc59T7C
+LL67FdO0+7mj/WNzHj3+9gyOYQyQgPVDaTmsJLbuzT2S+GpR94ZNliwL2NEa5baG
+B/Nb2ruRNj0GgZVw48N4XQ==
+-----END PRIVATE KEY-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/certs/valid/server/server.pem

@@ -0,0 +1,47 @@
+-----BEGIN CERTIFICATE-----
+MIIEhTCCA22gAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im3wwDQYJKoZIhvcNAQEL
+BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu
+ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt
+U2lnbmVkIFJvb3QgQ0EwHhcNMjQwMzE0MDAxMDAzWhcNNDMxMTMwMDAxMDAzWjBt
+MQswCQYDVQQGEwJVUzELMAkGA1UECAwCREUxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0
+d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxEjAQBgNV
+BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKEQ
+o7HfvvKa4ODbcHLlF7UMeLZGIEpIevzn9lNm7A//r2Uc3upNAQ7/8QwQVn35nB7N
+4kmx6OM/Yc7mVBltyxaiTeFszTBVP68CmSiA+8nxY0UVYV5kGcYuL/VYz1xJmlSw
+MnRcKwbRFO07bvB+BlCUpAxnFOR+L3vWg9jE1VKNObYlwtOS/BgjDGMlc8NM6BGj
+1MQBjdxaQKsEk3jDvgZYFMzkoMMDbfRPtbAu6/zVcPYu9iNhh0wEZzE+vm1hMiWn
+cudxtysNE2TelthCTRtEmCTDa9SS16JEaOS352BWctzr4whb5UtcSmP7Ow5nn9Hh
+3Wmh+qP2wPIM+G02vUkCAwEAAaOCAR4wggEaMAwGA1UdEwEB/wQCMAAwDgYDVR0P
+AQH/BAQDAgWgMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMC8GA1UdEQEB/wQlMCOC
+CWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATAdBgNVHQ4EFgQUJ90a
+UnXKPP13yDprLhG39fUrnu8wgZEGA1UdIwSBiTCBhqFupGwwajELMAkGA1UEBhMC
+VVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQL
+DA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJvb3QgQ0GC
+FA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAA4IBAQCVh4hiraRv
+JzYbS/TombP//xfVEWHXDBEYsT5GgWf7GPJ/QtSvv6uJFsK7heqLzf9f+r4Z5xMh
+YAkb0oe/Ge0T30Mo1YaBEqkKuQL9lOMcP69S9uFz2VT6I/76I8qqAu2AFhu74p8f
+qudwmQyRYo1Ryg4R/SgRhSJKF/ST/2wOusNWSsBe1s8S2PmtOb4dr3cMBGihrUzS
+DmCQpWjuiuE23HXnnYDc/EUAnEEPkLDgCsE9iLq37FPUHcHjqdYIAhmImPBpv2EL
+ftXeRWfxN2hRHpS5Fn3QuAOwfJw5tUcVXojJCJfSpL+Ac97iSjxNaDIPlyomauKw
+1rgbUkSw+9JQ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox
+CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv
+bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l
+ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG
+A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw
+FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv
+b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8
+RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He
+mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK
+na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6
+fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm
+zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy
+e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV
+GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws
+Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn
+9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ
+rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ
+6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg=
+-----END CERTIFICATE-----

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/compat.py

@@ -0,0 +1,23 @@
+import warnings
+
+try:
+    import StringIO
+except ImportError:
+    import io as StringIO
+
+try:
+    from cStringIO import StringIO as cStringIO
+except ImportError:
+    cStringIO = None
+
+
+def u(s):
+    warnings.warn(
+        (
+            "This helper function is no longer relevant in Python 3. "
+            "Usage of this alias should be discontinued as it will be "
+            "removed in a future release of Requests."
+        ),
+        DeprecationWarning,
+    )
+    return s

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/conftest.py

@@ -0,0 +1,58 @@
+try:
+    from http.server import HTTPServer, SimpleHTTPRequestHandler
+except ImportError:
+    from BaseHTTPServer import HTTPServer
+    from SimpleHTTPServer import SimpleHTTPRequestHandler
+
+import ssl
+import threading
+
+import pytest
+
+from requests.compat import urljoin
+
+
+def prepare_url(value):
+    # Issue #1483: Make sure the URL always has a trailing slash
+    httpbin_url = value.url.rstrip("/") + "/"
+
+    def inner(*suffix):
+        return urljoin(httpbin_url, "/".join(suffix))
+
+    return inner
+
+
+@pytest.fixture
+def httpbin(httpbin):
+    return prepare_url(httpbin)
+
+
+@pytest.fixture
+def httpbin_secure(httpbin_secure):
+    return prepare_url(httpbin_secure)
+
+
+@pytest.fixture
+def nosan_server(tmp_path_factory):
+    # delay importing until the fixture in order to make it possible
+    # to deselect the test via command-line when trustme is not available
+    import trustme
+
+    tmpdir = tmp_path_factory.mktemp("certs")
+    ca = trustme.CA()
+    # only commonName, no subjectAltName
+    server_cert = ca.issue_cert(common_name="localhost")
+    ca_bundle = str(tmpdir / "ca.pem")
+    ca.cert_pem.write_to_path(ca_bundle)
+
+    context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+    server_cert.configure_cert(context)
+    server = HTTPServer(("localhost", 0), SimpleHTTPRequestHandler)
+    server.socket = context.wrap_socket(server.socket, server_side=True)
+    server_thread = threading.Thread(target=server.serve_forever)
+    server_thread.start()
+
+    yield "localhost", server.server_address[1], ca_bundle
+
+    server.shutdown()
+    server_thread.join()

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_adapters.py

@@ -0,0 +1,8 @@
+import requests.adapters
+
+
+def test_request_url_trims_leading_path_separators():
+    """See also https://github.com/psf/requests/issues/6643."""
+    a = requests.adapters.HTTPAdapter()
+    p = requests.Request(method="GET", url="http://127.0.0.1:10000//v:h").prepare()
+    assert "/v:h" == a.request_url(p, {})

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_help.py

@@ -0,0 +1,27 @@
+from unittest import mock
+
+from requests.help import info
+
+
+def test_system_ssl():
+    """Verify we're actually setting system_ssl when it should be available."""
+    assert info()["system_ssl"]["version"] != ""
+
+
+class VersionedPackage:
+    def __init__(self, version):
+        self.__version__ = version
+
+
+def test_idna_without_version_attribute():
+    """Older versions of IDNA don't provide a __version__ attribute, verify
+    that if we have such a package, we don't blow up.
+    """
+    with mock.patch("requests.help.idna", new=None):
+        assert info()["idna"] == {"version": ""}
+
+
+def test_idna_with_version_attribute():
+    """Verify we're actually setting idna version when it should be available."""
+    with mock.patch("requests.help.idna", new=VersionedPackage("2.6")):
+        assert info()["idna"] == {"version": "2.6"}

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_hooks.py

@@ -0,0 +1,22 @@
+import pytest
+
+from requests import hooks
+
+
+def hook(value):
+    return value[1:]
+
+
+@pytest.mark.parametrize(
+    "hooks_list, result",
+    (
+        (hook, "ata"),
+        ([hook, lambda x: None, hook], "ta"),
+    ),
+)
+def test_hooks(hooks_list, result):
+    assert hooks.dispatch_hook("response", {"response": hooks_list}, "Data") == result
+
+
+def test_default_hooks():
+    assert hooks.default_hooks() == {"response": []}

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_lowlevel.py

@@ -0,0 +1,428 @@
+import threading
+
+import pytest
+from tests.testserver.server import Server, consume_socket_content
+
+import requests
+from requests.compat import JSONDecodeError
+
+from .utils import override_environ
+
+
+def echo_response_handler(sock):
+    """Simple handler that will take request and echo it back to requester."""
+    request_content = consume_socket_content(sock, timeout=0.5)
+
+    text_200 = (
+        b"HTTP/1.1 200 OK\r\n"
+        b"Content-Length: %d\r\n\r\n"
+        b"%s"
+    ) % (len(request_content), request_content)
+    sock.send(text_200)
+
+
+def test_chunked_upload():
+    """can safely send generators"""
+    close_server = threading.Event()
+    server = Server.basic_response_server(wait_to_close_event=close_server)
+    data = iter([b"a", b"b", b"c"])
+
+    with server as (host, port):
+        url = f"http://{host}:{port}/"
+        r = requests.post(url, data=data, stream=True)
+        close_server.set()  # release server block
+
+    assert r.status_code == 200
+    assert r.request.headers["Transfer-Encoding"] == "chunked"
+
+
+def test_chunked_encoding_error():
+    """get a ChunkedEncodingError if the server returns a bad response"""
+
+    def incomplete_chunked_response_handler(sock):
+        request_content = consume_socket_content(sock, timeout=0.5)
+
+        # The server never ends the request and doesn't provide any valid chunks
+        sock.send(
+            b"HTTP/1.1 200 OK\r\n"
+            b"Transfer-Encoding: chunked\r\n"
+        )
+
+        return request_content
+
+    close_server = threading.Event()
+    server = Server(incomplete_chunked_response_handler)
+
+    with server as (host, port):
+        url = f"http://{host}:{port}/"
+        with pytest.raises(requests.exceptions.ChunkedEncodingError):
+            requests.get(url)
+        close_server.set()  # release server block
+
+
+def test_chunked_upload_uses_only_specified_host_header():
+    """Ensure we use only the specified Host header for chunked requests."""
+    close_server = threading.Event()
+    server = Server(echo_response_handler, wait_to_close_event=close_server)
+
+    data = iter([b"a", b"b", b"c"])
+    custom_host = "sample-host"
+
+    with server as (host, port):
+        url = f"http://{host}:{port}/"
+        r = requests.post(url, data=data, headers={"Host": custom_host}, stream=True)
+        close_server.set()  # release server block
+
+    expected_header = b"Host: %s\r\n" % custom_host.encode("utf-8")
+    assert expected_header in r.content
+    assert r.content.count(b"Host: ") == 1
+
+
+def test_chunked_upload_doesnt_skip_host_header():
+    """Ensure we don't omit all Host headers with chunked requests."""
+    close_server = threading.Event()
+    server = Server(echo_response_handler, wait_to_close_event=close_server)
+
+    data = iter([b"a", b"b", b"c"])
+
+    with server as (host, port):
+        expected_host = f"{host}:{port}"
+        url = f"http://{host}:{port}/"
+        r = requests.post(url, data=data, stream=True)
+        close_server.set()  # release server block
+
+    expected_header = b"Host: %s\r\n" % expected_host.encode("utf-8")
+    assert expected_header in r.content
+    assert r.content.count(b"Host: ") == 1
+
+
+def test_conflicting_content_lengths():
+    """Ensure we correctly throw an InvalidHeader error if multiple
+    conflicting Content-Length headers are returned.
+    """
+
+    def multiple_content_length_response_handler(sock):
+        request_content = consume_socket_content(sock, timeout=0.5)
+        response = (
+            b"HTTP/1.1 200 OK\r\n"
+            b"Content-Type: text/plain\r\n"
+            b"Content-Length: 16\r\n"
+            b"Content-Length: 32\r\n\r\n"
+            b"-- Bad Actor -- Original Content\r\n"
+        )
+        sock.send(response)
+
+        return request_content
+
+    close_server = threading.Event()
+    server = Server(multiple_content_length_response_handler)
+
+    with server as (host, port):
+        url = f"http://{host}:{port}/"
+        with pytest.raises(requests.exceptions.InvalidHeader):
+            requests.get(url)
+        close_server.set()
+
+
+def test_digestauth_401_count_reset_on_redirect():
+    """Ensure we correctly reset num_401_calls after a successful digest auth,
+    followed by a 302 redirect to another digest auth prompt.
+
+    See https://github.com/psf/requests/issues/1979.
+    """
+    text_401 = (b'HTTP/1.1 401 UNAUTHORIZED\r\n'
+                b'Content-Length: 0\r\n'
+                b'WWW-Authenticate: Digest nonce="6bf5d6e4da1ce66918800195d6b9130d"'
+                b', opaque="372825293d1c26955496c80ed6426e9e", '
+                b'realm="me@kennethreitz.com", qop=auth\r\n\r\n')
+
+    text_302 = (b'HTTP/1.1 302 FOUND\r\n'
+                b'Content-Length: 0\r\n'
+                b'Location: /\r\n\r\n')
+
+    text_200 = (b'HTTP/1.1 200 OK\r\n'
+                b'Content-Length: 0\r\n\r\n')
+
+    expected_digest = (b'Authorization: Digest username="user", '
+                       b'realm="me@kennethreitz.com", '
+                       b'nonce="6bf5d6e4da1ce66918800195d6b9130d", uri="/"')
+
+    auth = requests.auth.HTTPDigestAuth('user', 'pass')
+
+    def digest_response_handler(sock):
+        # Respond to initial GET with a challenge.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert request_content.startswith(b"GET / HTTP/1.1")
+        sock.send(text_401)
+
+        # Verify we receive an Authorization header in response, then redirect.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert expected_digest in request_content
+        sock.send(text_302)
+
+        # Verify Authorization isn't sent to the redirected host,
+        # then send another challenge.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert b'Authorization:' not in request_content
+        sock.send(text_401)
+
+        # Verify Authorization is sent correctly again, and return 200 OK.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert expected_digest in request_content
+        sock.send(text_200)
+
+        return request_content
+
+    close_server = threading.Event()
+    server = Server(digest_response_handler, wait_to_close_event=close_server)
+
+    with server as (host, port):
+        url = f'http://{host}:{port}/'
+        r = requests.get(url, auth=auth)
+        # Verify server succeeded in authenticating.
+        assert r.status_code == 200
+        # Verify Authorization was sent in final request.
+        assert 'Authorization' in r.request.headers
+        assert r.request.headers['Authorization'].startswith('Digest ')
+        # Verify redirect happened as we expected.
+        assert r.history[0].status_code == 302
+        close_server.set()
+
+
+def test_digestauth_401_only_sent_once():
+    """Ensure we correctly respond to a 401 challenge once, and then
+    stop responding if challenged again.
+    """
+    text_401 = (b'HTTP/1.1 401 UNAUTHORIZED\r\n'
+                b'Content-Length: 0\r\n'
+                b'WWW-Authenticate: Digest nonce="6bf5d6e4da1ce66918800195d6b9130d"'
+                b', opaque="372825293d1c26955496c80ed6426e9e", '
+                b'realm="me@kennethreitz.com", qop=auth\r\n\r\n')
+
+    expected_digest = (b'Authorization: Digest username="user", '
+                       b'realm="me@kennethreitz.com", '
+                       b'nonce="6bf5d6e4da1ce66918800195d6b9130d", uri="/"')
+
+    auth = requests.auth.HTTPDigestAuth('user', 'pass')
+
+    def digest_failed_response_handler(sock):
+        # Respond to initial GET with a challenge.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert request_content.startswith(b"GET / HTTP/1.1")
+        sock.send(text_401)
+
+        # Verify we receive an Authorization header in response, then
+        # challenge again.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert expected_digest in request_content
+        sock.send(text_401)
+
+        # Verify the client didn't respond to second challenge.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert request_content == b''
+
+        return request_content
+
+    close_server = threading.Event()
+    server = Server(digest_failed_response_handler, wait_to_close_event=close_server)
+
+    with server as (host, port):
+        url = f'http://{host}:{port}/'
+        r = requests.get(url, auth=auth)
+        # Verify server didn't authenticate us.
+        assert r.status_code == 401
+        assert r.history[0].status_code == 401
+        close_server.set()
+
+
+def test_digestauth_only_on_4xx():
+    """Ensure we only send digestauth on 4xx challenges.
+
+    See https://github.com/psf/requests/issues/3772.
+    """
+    text_200_chal = (b'HTTP/1.1 200 OK\r\n'
+                     b'Content-Length: 0\r\n'
+                     b'WWW-Authenticate: Digest nonce="6bf5d6e4da1ce66918800195d6b9130d"'
+                     b', opaque="372825293d1c26955496c80ed6426e9e", '
+                     b'realm="me@kennethreitz.com", qop=auth\r\n\r\n')
+
+    auth = requests.auth.HTTPDigestAuth('user', 'pass')
+
+    def digest_response_handler(sock):
+        # Respond to GET with a 200 containing www-authenticate header.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert request_content.startswith(b"GET / HTTP/1.1")
+        sock.send(text_200_chal)
+
+        # Verify the client didn't respond with auth.
+        request_content = consume_socket_content(sock, timeout=0.5)
+        assert request_content == b''
+
+        return request_content
+
+    close_server = threading.Event()
+    server = Server(digest_response_handler, wait_to_close_event=close_server)
+
+    with server as (host, port):
+        url = f'http://{host}:{port}/'
+        r = requests.get(url, auth=auth)
+        # Verify server didn't receive auth from us.
+        assert r.status_code == 200
+        assert len(r.history) == 0
+        close_server.set()
+
+
+_schemes_by_var_prefix = [
+    ('http', ['http']),
+    ('https', ['https']),
+    ('all', ['http', 'https']),
+]
+
+_proxy_combos = []
+for prefix, schemes in _schemes_by_var_prefix:
+    for scheme in schemes:
+        _proxy_combos.append((f"{prefix}_proxy", scheme))
+
+_proxy_combos += [(var.upper(), scheme) for var, scheme in _proxy_combos]
+
+
+@pytest.mark.parametrize("var,scheme", _proxy_combos)
+def test_use_proxy_from_environment(httpbin, var, scheme):
+    url = f"{scheme}://httpbin.org"
+    fake_proxy = Server()  # do nothing with the requests; just close the socket
+    with fake_proxy as (host, port):
+        proxy_url = f"socks5://{host}:{port}"
+        kwargs = {var: proxy_url}
+        with override_environ(**kwargs):
+            # fake proxy's lack of response will cause a ConnectionError
+            with pytest.raises(requests.exceptions.ConnectionError):
+                requests.get(url)
+
+        # the fake proxy received a request
+        assert len(fake_proxy.handler_results) == 1
+
+        # it had actual content (not checking for SOCKS protocol for now)
+        assert len(fake_proxy.handler_results[0]) > 0
+
+
+def test_redirect_rfc1808_to_non_ascii_location():
+    path = 'š'
+    expected_path = b'%C5%A1'
+    redirect_request = []  # stores the second request to the server
+
+    def redirect_resp_handler(sock):
+        consume_socket_content(sock, timeout=0.5)
+        location = f'//{host}:{port}/{path}'
+        sock.send(
+            (
+                b'HTTP/1.1 301 Moved Permanently\r\n'
+                b'Content-Length: 0\r\n'
+                b'Location: %s\r\n'
+                b'\r\n'
+            ) % location.encode('utf8')
+        )
+        redirect_request.append(consume_socket_content(sock, timeout=0.5))
+        sock.send(b'HTTP/1.1 200 OK\r\n\r\n')
+
+    close_server = threading.Event()
+    server = Server(redirect_resp_handler, wait_to_close_event=close_server)
+
+    with server as (host, port):
+        url = f'http://{host}:{port}'
+        r = requests.get(url=url, allow_redirects=True)
+        assert r.status_code == 200
+        assert len(r.history) == 1
+        assert r.history[0].status_code == 301
+        assert redirect_request[0].startswith(b'GET /' + expected_path + b' HTTP/1.1')
+        assert r.url == '{}/{}'.format(url, expected_path.decode('ascii'))
+
+        close_server.set()
+
+
+def test_fragment_not_sent_with_request():
+    """Verify that the fragment portion of a URI isn't sent to the server."""
+    close_server = threading.Event()
+    server = Server(echo_response_handler, wait_to_close_event=close_server)
+
+    with server as (host, port):
+        url = f'http://{host}:{port}/path/to/thing/#view=edit&token=hunter2'
+        r = requests.get(url)
+        raw_request = r.content
+
+        assert r.status_code == 200
+        headers, body = raw_request.split(b'\r\n\r\n', 1)
+        status_line, headers = headers.split(b'\r\n', 1)
+
+        assert status_line == b'GET /path/to/thing/ HTTP/1.1'
+        for frag in (b'view', b'edit', b'token', b'hunter2'):
+            assert frag not in headers
+            assert frag not in body
+
+        close_server.set()
+
+
+def test_fragment_update_on_redirect():
+    """Verify we only append previous fragment if one doesn't exist on new
+    location. If a new fragment is encountered in a Location header, it should
+    be added to all subsequent requests.
+    """
+
+    def response_handler(sock):
+        consume_socket_content(sock, timeout=0.5)
+        sock.send(
+            b'HTTP/1.1 302 FOUND\r\n'
+            b'Content-Length: 0\r\n'
+            b'Location: /get#relevant-section\r\n\r\n'
+        )
+        consume_socket_content(sock, timeout=0.5)
+        sock.send(
+            b'HTTP/1.1 302 FOUND\r\n'
+            b'Content-Length: 0\r\n'
+            b'Location: /final-url/\r\n\r\n'
+        )
+        consume_socket_content(sock, timeout=0.5)
+        sock.send(
+            b'HTTP/1.1 200 OK\r\n\r\n'
+        )
+
+    close_server = threading.Event()
+    server = Server(response_handler, wait_to_close_event=close_server)
+
+    with server as (host, port):
+        url = f'http://{host}:{port}/path/to/thing/#view=edit&token=hunter2'
+        r = requests.get(url)
+
+        assert r.status_code == 200
+        assert len(r.history) == 2
+        assert r.history[0].request.url == url
+
+        # Verify we haven't overwritten the location with our previous fragment.
+        assert r.history[1].request.url == f'http://{host}:{port}/get#relevant-section'
+        # Verify previous fragment is used and not the original.
+        assert r.url == f'http://{host}:{port}/final-url/#relevant-section'
+
+        close_server.set()
+
+
+def test_json_decode_compatibility_for_alt_utf_encodings():
+
+    def response_handler(sock):
+        consume_socket_content(sock, timeout=0.5)
+        sock.send(
+            b'HTTP/1.1 200 OK\r\n'
+            b'Content-Length: 18\r\n\r\n'
+            b'\xff\xfe{\x00"\x00K0"\x00=\x00"\x00\xab0"\x00\r\n'
+        )
+
+    close_server = threading.Event()
+    server = Server(response_handler, wait_to_close_event=close_server)
+
+    with server as (host, port):
+        url = f'http://{host}:{port}/'
+        r = requests.get(url)
+    r.encoding = None
+    with pytest.raises(requests.exceptions.JSONDecodeError) as excinfo:
+        r.json()
+    assert isinstance(excinfo.value, requests.exceptions.RequestException)
+    assert isinstance(excinfo.value, JSONDecodeError)
+    assert r.text not in str(excinfo.value)

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_packages.py

@@ -0,0 +1,13 @@
+import requests
+
+
+def test_can_access_urllib3_attribute():
+    requests.packages.urllib3
+
+
+def test_can_access_idna_attribute():
+    requests.packages.idna
+
+
+def test_can_access_chardet_attribute():
+    requests.packages.chardet

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_structures.py

@@ -0,0 +1,78 @@
+import pytest
+
+from requests.structures import CaseInsensitiveDict, LookupDict
+
+
+class TestCaseInsensitiveDict:
+    @pytest.fixture(autouse=True)
+    def setup(self):
+        """CaseInsensitiveDict instance with "Accept" header."""
+        self.case_insensitive_dict = CaseInsensitiveDict()
+        self.case_insensitive_dict["Accept"] = "application/json"
+
+    def test_list(self):
+        assert list(self.case_insensitive_dict) == ["Accept"]
+
+    possible_keys = pytest.mark.parametrize(
+        "key", ("accept", "ACCEPT", "aCcEpT", "Accept")
+    )
+
+    @possible_keys
+    def test_getitem(self, key):
+        assert self.case_insensitive_dict[key] == "application/json"
+
+    @possible_keys
+    def test_delitem(self, key):
+        del self.case_insensitive_dict[key]
+        assert key not in self.case_insensitive_dict
+
+    def test_lower_items(self):
+        assert list(self.case_insensitive_dict.lower_items()) == [
+            ("accept", "application/json")
+        ]
+
+    def test_repr(self):
+        assert repr(self.case_insensitive_dict) == "{'Accept': 'application/json'}"
+
+    def test_copy(self):
+        copy = self.case_insensitive_dict.copy()
+        assert copy is not self.case_insensitive_dict
+        assert copy == self.case_insensitive_dict
+
+    @pytest.mark.parametrize(
+        "other, result",
+        (
+            ({"AccePT": "application/json"}, True),
+            ({}, False),
+            (None, False),
+        ),
+    )
+    def test_instance_equality(self, other, result):
+        assert (self.case_insensitive_dict == other) is result
+
+
+class TestLookupDict:
+    @pytest.fixture(autouse=True)
+    def setup(self):
+        """LookupDict instance with "bad_gateway" attribute."""
+        self.lookup_dict = LookupDict("test")
+        self.lookup_dict.bad_gateway = 502
+
+    def test_repr(self):
+        assert repr(self.lookup_dict) == "<lookup 'test'>"
+
+    get_item_parameters = pytest.mark.parametrize(
+        "key, value",
+        (
+            ("bad_gateway", 502),
+            ("not_a_key", None),
+        ),
+    )
+
+    @get_item_parameters
+    def test_getitem(self, key, value):
+        assert self.lookup_dict[key] == value
+
+    @get_item_parameters
+    def test_get(self, key, value):
+        assert self.lookup_dict.get(key) == value

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_testserver.py

@@ -0,0 +1,165 @@
+import socket
+import threading
+import time
+
+import pytest
+from tests.testserver.server import Server
+
+import requests
+
+
+class TestTestServer:
+    def test_basic(self):
+        """messages are sent and received properly"""
+        question = b"success?"
+        answer = b"yeah, success"
+
+        def handler(sock):
+            text = sock.recv(1000)
+            assert text == question
+            sock.sendall(answer)
+
+        with Server(handler) as (host, port):
+            sock = socket.socket()
+            sock.connect((host, port))
+            sock.sendall(question)
+            text = sock.recv(1000)
+            assert text == answer
+            sock.close()
+
+    def test_server_closes(self):
+        """the server closes when leaving the context manager"""
+        with Server.basic_response_server() as (host, port):
+            sock = socket.socket()
+            sock.connect((host, port))
+
+            sock.close()
+
+        with pytest.raises(socket.error):
+            new_sock = socket.socket()
+            new_sock.connect((host, port))
+
+    def test_text_response(self):
+        """the text_response_server sends the given text"""
+        server = Server.text_response_server(
+            "HTTP/1.1 200 OK\r\n" "Content-Length: 6\r\n" "\r\nroflol"
+        )
+
+        with server as (host, port):
+            r = requests.get(f"http://{host}:{port}")
+
+            assert r.status_code == 200
+            assert r.text == "roflol"
+            assert r.headers["Content-Length"] == "6"
+
+    def test_basic_response(self):
+        """the basic response server returns an empty http response"""
+        with Server.basic_response_server() as (host, port):
+            r = requests.get(f"http://{host}:{port}")
+            assert r.status_code == 200
+            assert r.text == ""
+            assert r.headers["Content-Length"] == "0"
+
+    def test_basic_waiting_server(self):
+        """the server waits for the block_server event to be set before closing"""
+        block_server = threading.Event()
+
+        with Server.basic_response_server(wait_to_close_event=block_server) as (
+            host,
+            port,
+        ):
+            sock = socket.socket()
+            sock.connect((host, port))
+            sock.sendall(b"send something")
+            time.sleep(2.5)
+            sock.sendall(b"still alive")
+            block_server.set()  # release server block
+
+    def test_multiple_requests(self):
+        """multiple requests can be served"""
+        requests_to_handle = 5
+
+        server = Server.basic_response_server(requests_to_handle=requests_to_handle)
+
+        with server as (host, port):
+            server_url = f"http://{host}:{port}"
+            for _ in range(requests_to_handle):
+                r = requests.get(server_url)
+                assert r.status_code == 200
+
+            # the (n+1)th request fails
+            with pytest.raises(requests.exceptions.ConnectionError):
+                r = requests.get(server_url)
+
+    @pytest.mark.skip(reason="this fails non-deterministically under pytest-xdist")
+    def test_request_recovery(self):
+        """can check the requests content"""
+        # TODO: figure out why this sometimes fails when using pytest-xdist.
+        server = Server.basic_response_server(requests_to_handle=2)
+        first_request = b"put your hands up in the air"
+        second_request = b"put your hand down in the floor"
+
+        with server as address:
+            sock1 = socket.socket()
+            sock2 = socket.socket()
+
+            sock1.connect(address)
+            sock1.sendall(first_request)
+            sock1.close()
+
+            sock2.connect(address)
+            sock2.sendall(second_request)
+            sock2.close()
+
+        assert server.handler_results[0] == first_request
+        assert server.handler_results[1] == second_request
+
+    def test_requests_after_timeout_are_not_received(self):
+        """the basic response handler times out when receiving requests"""
+        server = Server.basic_response_server(request_timeout=1)
+
+        with server as address:
+            sock = socket.socket()
+            sock.connect(address)
+            time.sleep(1.5)
+            sock.sendall(b"hehehe, not received")
+            sock.close()
+
+        assert server.handler_results[0] == b""
+
+    def test_request_recovery_with_bigger_timeout(self):
+        """a biggest timeout can be specified"""
+        server = Server.basic_response_server(request_timeout=3)
+        data = b"bananadine"
+
+        with server as address:
+            sock = socket.socket()
+            sock.connect(address)
+            time.sleep(1.5)
+            sock.sendall(data)
+            sock.close()
+
+        assert server.handler_results[0] == data
+
+    def test_server_finishes_on_error(self):
+        """the server thread exits even if an exception exits the context manager"""
+        server = Server.basic_response_server()
+        with pytest.raises(Exception):
+            with server:
+                raise Exception()
+
+        assert len(server.handler_results) == 0
+
+        # if the server thread fails to finish, the test suite will hang
+        # and get killed by the jenkins timeout.
+
+    def test_server_finishes_when_no_connections(self):
+        """the server thread exits even if there are no connections"""
+        server = Server.basic_response_server()
+        with server:
+            pass
+
+        assert len(server.handler_results) == 0
+
+        # if the server thread fails to finish, the test suite will hang
+        # and get killed by the jenkins timeout.

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/test_utils.py

@@ -0,0 +1,958 @@
+import copy
+import filecmp
+import os
+import tarfile
+import zipfile
+from collections import deque
+from io import BytesIO
+from unittest import mock
+
+import pytest
+
+from requests import compat
+from requests._internal_utils import unicode_is_ascii
+from requests.cookies import RequestsCookieJar
+from requests.structures import CaseInsensitiveDict
+from requests.utils import (
+    _parse_content_type_header,
+    add_dict_to_cookiejar,
+    address_in_network,
+    dotted_netmask,
+    extract_zipped_paths,
+    get_auth_from_url,
+    get_encoding_from_headers,
+    get_encodings_from_content,
+    get_environ_proxies,
+    guess_filename,
+    guess_json_utf,
+    is_ipv4_address,
+    is_valid_cidr,
+    iter_slices,
+    parse_dict_header,
+    parse_header_links,
+    prepend_scheme_if_needed,
+    requote_uri,
+    select_proxy,
+    set_environ,
+    should_bypass_proxies,
+    super_len,
+    to_key_val_list,
+    to_native_string,
+    unquote_header_value,
+    unquote_unreserved,
+    urldefragauth,
+)
+
+from .compat import StringIO, cStringIO
+
+
+class TestSuperLen:
+    @pytest.mark.parametrize(
+        "stream, value",
+        (
+            (StringIO.StringIO, "Test"),
+            (BytesIO, b"Test"),
+            pytest.param(
+                cStringIO, "Test", marks=pytest.mark.skipif("cStringIO is None")
+            ),
+        ),
+    )
+    def test_io_streams(self, stream, value):
+        """Ensures that we properly deal with different kinds of IO streams."""
+        assert super_len(stream()) == 0
+        assert super_len(stream(value)) == 4
+
+    def test_super_len_correctly_calculates_len_of_partially_read_file(self):
+        """Ensure that we handle partially consumed file like objects."""
+        s = StringIO.StringIO()
+        s.write("foobarbogus")
+        assert super_len(s) == 0
+
+    @pytest.mark.parametrize("error", [IOError, OSError])
+    def test_super_len_handles_files_raising_weird_errors_in_tell(self, error):
+        """If tell() raises errors, assume the cursor is at position zero."""
+
+        class BoomFile:
+            def __len__(self):
+                return 5
+
+            def tell(self):
+                raise error()
+
+        assert super_len(BoomFile()) == 0
+
+    @pytest.mark.parametrize("error", [IOError, OSError])
+    def test_super_len_tell_ioerror(self, error):
+        """Ensure that if tell gives an IOError super_len doesn't fail"""
+
+        class NoLenBoomFile:
+            def tell(self):
+                raise error()
+
+            def seek(self, offset, whence):
+                pass
+
+        assert super_len(NoLenBoomFile()) == 0
+
+    def test_string(self):
+        assert super_len("Test") == 4
+
+    @pytest.mark.parametrize(
+        "mode, warnings_num",
+        (
+            ("r", 1),
+            ("rb", 0),
+        ),
+    )
+    def test_file(self, tmpdir, mode, warnings_num, recwarn):
+        file_obj = tmpdir.join("test.txt")
+        file_obj.write("Test")
+        with file_obj.open(mode) as fd:
+            assert super_len(fd) == 4
+        assert len(recwarn) == warnings_num
+
+    def test_tarfile_member(self, tmpdir):
+        file_obj = tmpdir.join("test.txt")
+        file_obj.write("Test")
+
+        tar_obj = str(tmpdir.join("test.tar"))
+        with tarfile.open(tar_obj, "w") as tar:
+            tar.add(str(file_obj), arcname="test.txt")
+
+        with tarfile.open(tar_obj) as tar:
+            member = tar.extractfile("test.txt")
+            assert super_len(member) == 4
+
+    def test_super_len_with__len__(self):
+        foo = [1, 2, 3, 4]
+        len_foo = super_len(foo)
+        assert len_foo == 4
+
+    def test_super_len_with_no__len__(self):
+        class LenFile:
+            def __init__(self):
+                self.len = 5
+
+        assert super_len(LenFile()) == 5
+
+    def test_super_len_with_tell(self):
+        foo = StringIO.StringIO("12345")
+        assert super_len(foo) == 5
+        foo.read(2)
+        assert super_len(foo) == 3
+
+    def test_super_len_with_fileno(self):
+        with open(__file__, "rb") as f:
+            length = super_len(f)
+            file_data = f.read()
+        assert length == len(file_data)
+
+    def test_super_len_with_no_matches(self):
+        """Ensure that objects without any length methods default to 0"""
+        assert super_len(object()) == 0
+
+
+class TestToKeyValList:
+    @pytest.mark.parametrize(
+        "value, expected",
+        (
+            ([("key", "val")], [("key", "val")]),
+            ((("key", "val"),), [("key", "val")]),
+            ({"key": "val"}, [("key", "val")]),
+            (None, None),
+        ),
+    )
+    def test_valid(self, value, expected):
+        assert to_key_val_list(value) == expected
+
+    def test_invalid(self):
+        with pytest.raises(ValueError):
+            to_key_val_list("string")
+
+
+class TestUnquoteHeaderValue:
+    @pytest.mark.parametrize(
+        "value, expected",
+        (
+            (None, None),
+            ("Test", "Test"),
+            ('"Test"', "Test"),
+            ('"Test\\\\"', "Test\\"),
+            ('"\\\\Comp\\Res"', "\\Comp\\Res"),
+        ),
+    )
+    def test_valid(self, value, expected):
+        assert unquote_header_value(value) == expected
+
+    def test_is_filename(self):
+        assert unquote_header_value('"\\\\Comp\\Res"', True) == "\\\\Comp\\Res"
+
+
+class TestGetEnvironProxies:
+    """Ensures that IP addresses are correctly matches with ranges
+    in no_proxy variable.
+    """
+
+    @pytest.fixture(autouse=True, params=["no_proxy", "NO_PROXY"])
+    def no_proxy(self, request, monkeypatch):
+        monkeypatch.setenv(
+            request.param, "192.168.0.0/24,127.0.0.1,localhost.localdomain,172.16.1.1"
+        )
+
+    @pytest.mark.parametrize(
+        "url",
+        (
+            "http://192.168.0.1:5000/",
+            "http://192.168.0.1/",
+            "http://172.16.1.1/",
+            "http://172.16.1.1:5000/",
+            "http://localhost.localdomain:5000/v1.0/",
+        ),
+    )
+    def test_bypass(self, url):
+        assert get_environ_proxies(url, no_proxy=None) == {}
+
+    @pytest.mark.parametrize(
+        "url",
+        (
+            "http://192.168.1.1:5000/",
+            "http://192.168.1.1/",
+            "http://www.requests.com/",
+        ),
+    )
+    def test_not_bypass(self, url):
+        assert get_environ_proxies(url, no_proxy=None) != {}
+
+    @pytest.mark.parametrize(
+        "url",
+        (
+            "http://192.168.1.1:5000/",
+            "http://192.168.1.1/",
+            "http://www.requests.com/",
+        ),
+    )
+    def test_bypass_no_proxy_keyword(self, url):
+        no_proxy = "192.168.1.1,requests.com"
+        assert get_environ_proxies(url, no_proxy=no_proxy) == {}
+
+    @pytest.mark.parametrize(
+        "url",
+        (
+            "http://192.168.0.1:5000/",
+            "http://192.168.0.1/",
+            "http://172.16.1.1/",
+            "http://172.16.1.1:5000/",
+            "http://localhost.localdomain:5000/v1.0/",
+        ),
+    )
+    def test_not_bypass_no_proxy_keyword(self, url, monkeypatch):
+        # This is testing that the 'no_proxy' argument overrides the
+        # environment variable 'no_proxy'
+        monkeypatch.setenv("http_proxy", "http://proxy.example.com:3128/")
+        no_proxy = "192.168.1.1,requests.com"
+        assert get_environ_proxies(url, no_proxy=no_proxy) != {}
+
+
+class TestIsIPv4Address:
+    def test_valid(self):
+        assert is_ipv4_address("8.8.8.8")
+
+    @pytest.mark.parametrize("value", ("8.8.8.8.8", "localhost.localdomain"))
+    def test_invalid(self, value):
+        assert not is_ipv4_address(value)
+
+
+class TestIsValidCIDR:
+    def test_valid(self):
+        assert is_valid_cidr("192.168.1.0/24")
+
+    @pytest.mark.parametrize(
+        "value",
+        (
+            "8.8.8.8",
+            "192.168.1.0/a",
+            "192.168.1.0/128",
+            "192.168.1.0/-1",
+            "192.168.1.999/24",
+        ),
+    )
+    def test_invalid(self, value):
+        assert not is_valid_cidr(value)
+
+
+class TestAddressInNetwork:
+    def test_valid(self):
+        assert address_in_network("192.168.1.1", "192.168.1.0/24")
+
+    def test_invalid(self):
+        assert not address_in_network("172.16.0.1", "192.168.1.0/24")
+
+
+class TestGuessFilename:
+    @pytest.mark.parametrize(
+        "value",
+        (1, type("Fake", (object,), {"name": 1})()),
+    )
+    def test_guess_filename_invalid(self, value):
+        assert guess_filename(value) is None
+
+    @pytest.mark.parametrize(
+        "value, expected_type",
+        (
+            (b"value", compat.bytes),
+            (b"value".decode("utf-8"), compat.str),
+        ),
+    )
+    def test_guess_filename_valid(self, value, expected_type):
+        obj = type("Fake", (object,), {"name": value})()
+        result = guess_filename(obj)
+        assert result == value
+        assert isinstance(result, expected_type)
+
+
+class TestExtractZippedPaths:
+    @pytest.mark.parametrize(
+        "path",
+        (
+            "/",
+            __file__,
+            pytest.__file__,
+            "/etc/invalid/location",
+        ),
+    )
+    def test_unzipped_paths_unchanged(self, path):
+        assert path == extract_zipped_paths(path)
+
+    def test_zipped_paths_extracted(self, tmpdir):
+        zipped_py = tmpdir.join("test.zip")
+        with zipfile.ZipFile(zipped_py.strpath, "w") as f:
+            f.write(__file__)
+
+        _, name = os.path.splitdrive(__file__)
+        zipped_path = os.path.join(zipped_py.strpath, name.lstrip(r"\/"))
+        extracted_path = extract_zipped_paths(zipped_path)
+
+        assert extracted_path != zipped_path
+        assert os.path.exists(extracted_path)
+        assert filecmp.cmp(extracted_path, __file__)
+
+    def test_invalid_unc_path(self):
+        path = r"\\localhost\invalid\location"
+        assert extract_zipped_paths(path) == path
+
+
+class TestContentEncodingDetection:
+    def test_none(self):
+        encodings = get_encodings_from_content("")
+        assert not len(encodings)
+
+    @pytest.mark.parametrize(
+        "content",
+        (
+            # HTML5 meta charset attribute
+            '<meta charset="UTF-8">',
+            # HTML4 pragma directive
+            '<meta http-equiv="Content-type" content="text/html;charset=UTF-8">',
+            # XHTML 1.x served with text/html MIME type
+            '<meta http-equiv="Content-type" content="text/html;charset=UTF-8" />',
+            # XHTML 1.x served as XML
+            '<?xml version="1.0" encoding="UTF-8"?>',
+        ),
+    )
+    def test_pragmas(self, content):
+        encodings = get_encodings_from_content(content)
+        assert len(encodings) == 1
+        assert encodings[0] == "UTF-8"
+
+    def test_precedence(self):
+        content = """
+        <?xml version="1.0" encoding="XML"?>
+        <meta charset="HTML5">
+        <meta http-equiv="Content-type" content="text/html;charset=HTML4" />
+        """.strip()
+        assert get_encodings_from_content(content) == ["HTML5", "HTML4", "XML"]
+
+
+class TestGuessJSONUTF:
+    @pytest.mark.parametrize(
+        "encoding",
+        (
+            "utf-32",
+            "utf-8-sig",
+            "utf-16",
+            "utf-8",
+            "utf-16-be",
+            "utf-16-le",
+            "utf-32-be",
+            "utf-32-le",
+        ),
+    )
+    def test_encoded(self, encoding):
+        data = "{}".encode(encoding)
+        assert guess_json_utf(data) == encoding
+
+    def test_bad_utf_like_encoding(self):
+        assert guess_json_utf(b"\x00\x00\x00\x00") is None
+
+    @pytest.mark.parametrize(
+        ("encoding", "expected"),
+        (
+            ("utf-16-be", "utf-16"),
+            ("utf-16-le", "utf-16"),
+            ("utf-32-be", "utf-32"),
+            ("utf-32-le", "utf-32"),
+        ),
+    )
+    def test_guess_by_bom(self, encoding, expected):
+        data = "\ufeff{}".encode(encoding)
+        assert guess_json_utf(data) == expected
+
+
+USER = PASSWORD = "%!*'();:@&=+$,/?#[] "
+ENCODED_USER = compat.quote(USER, "")
+ENCODED_PASSWORD = compat.quote(PASSWORD, "")
+
+
+@pytest.mark.parametrize(
+    "url, auth",
+    (
+        (
+            f"http://{ENCODED_USER}:{ENCODED_PASSWORD}@request.com/url.html#test",
+            (USER, PASSWORD),
+        ),
+        ("http://user:pass@complex.url.com/path?query=yes", ("user", "pass")),
+        (
+            "http://user:pass%20pass@complex.url.com/path?query=yes",
+            ("user", "pass pass"),
+        ),
+        ("http://user:pass pass@complex.url.com/path?query=yes", ("user", "pass pass")),
+        (
+            "http://user%25user:pass@complex.url.com/path?query=yes",
+            ("user%user", "pass"),
+        ),
+        (
+            "http://user:pass%23pass@complex.url.com/path?query=yes",
+            ("user", "pass#pass"),
+        ),
+        ("http://complex.url.com/path?query=yes", ("", "")),
+    ),
+)
+def test_get_auth_from_url(url, auth):
+    assert get_auth_from_url(url) == auth
+
+
+@pytest.mark.parametrize(
+    "uri, expected",
+    (
+        (
+            # Ensure requoting doesn't break expectations
+            "http://example.com/fiz?buz=%25ppicture",
+            "http://example.com/fiz?buz=%25ppicture",
+        ),
+        (
+            # Ensure we handle unquoted percent signs in redirects
+            "http://example.com/fiz?buz=%ppicture",
+            "http://example.com/fiz?buz=%25ppicture",
+        ),
+    ),
+)
+def test_requote_uri_with_unquoted_percents(uri, expected):
+    """See: https://github.com/psf/requests/issues/2356"""
+    assert requote_uri(uri) == expected
+
+
+@pytest.mark.parametrize(
+    "uri, expected",
+    (
+        (
+            # Illegal bytes
+            "http://example.com/?a=%--",
+            "http://example.com/?a=%--",
+        ),
+        (
+            # Reserved characters
+            "http://example.com/?a=%300",
+            "http://example.com/?a=00",
+        ),
+    ),
+)
+def test_unquote_unreserved(uri, expected):
+    assert unquote_unreserved(uri) == expected
+
+
+@pytest.mark.parametrize(
+    "mask, expected",
+    (
+        (8, "255.0.0.0"),
+        (24, "255.255.255.0"),
+        (25, "255.255.255.128"),
+    ),
+)
+def test_dotted_netmask(mask, expected):
+    assert dotted_netmask(mask) == expected
+
+
+http_proxies = {
+    "http": "http://http.proxy",
+    "http://some.host": "http://some.host.proxy",
+}
+all_proxies = {
+    "all": "socks5://http.proxy",
+    "all://some.host": "socks5://some.host.proxy",
+}
+mixed_proxies = {
+    "http": "http://http.proxy",
+    "http://some.host": "http://some.host.proxy",
+    "all": "socks5://http.proxy",
+}
+
+
+@pytest.mark.parametrize(
+    "url, expected, proxies",
+    (
+        ("hTTp://u:p@Some.Host/path", "http://some.host.proxy", http_proxies),
+        ("hTTp://u:p@Other.Host/path", "http://http.proxy", http_proxies),
+        ("hTTp:///path", "http://http.proxy", http_proxies),
+        ("hTTps://Other.Host", None, http_proxies),
+        ("file:///etc/motd", None, http_proxies),
+        ("hTTp://u:p@Some.Host/path", "socks5://some.host.proxy", all_proxies),
+        ("hTTp://u:p@Other.Host/path", "socks5://http.proxy", all_proxies),
+        ("hTTp:///path", "socks5://http.proxy", all_proxies),
+        ("hTTps://Other.Host", "socks5://http.proxy", all_proxies),
+        ("http://u:p@other.host/path", "http://http.proxy", mixed_proxies),
+        ("http://u:p@some.host/path", "http://some.host.proxy", mixed_proxies),
+        ("https://u:p@other.host/path", "socks5://http.proxy", mixed_proxies),
+        ("https://u:p@some.host/path", "socks5://http.proxy", mixed_proxies),
+        ("https://", "socks5://http.proxy", mixed_proxies),
+        # XXX: unsure whether this is reasonable behavior
+        ("file:///etc/motd", "socks5://http.proxy", all_proxies),
+    ),
+)
+def test_select_proxies(url, expected, proxies):
+    """Make sure we can select per-host proxies correctly."""
+    assert select_proxy(url, proxies) == expected
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    (
+        ('foo="is a fish", bar="as well"', {"foo": "is a fish", "bar": "as well"}),
+        ("key_without_value", {"key_without_value": None}),
+    ),
+)
+def test_parse_dict_header(value, expected):
+    assert parse_dict_header(value) == expected
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    (
+        ("application/xml", ("application/xml", {})),
+        (
+            "application/json ; charset=utf-8",
+            ("application/json", {"charset": "utf-8"}),
+        ),
+        (
+            "application/json ; Charset=utf-8",
+            ("application/json", {"charset": "utf-8"}),
+        ),
+        ("text/plain", ("text/plain", {})),
+        (
+            "multipart/form-data; boundary = something ; boundary2='something_else' ; no_equals ",
+            (
+                "multipart/form-data",
+                {
+                    "boundary": "something",
+                    "boundary2": "something_else",
+                    "no_equals": True,
+                },
+            ),
+        ),
+        (
+            'multipart/form-data; boundary = something ; boundary2="something_else" ; no_equals ',
+            (
+                "multipart/form-data",
+                {
+                    "boundary": "something",
+                    "boundary2": "something_else",
+                    "no_equals": True,
+                },
+            ),
+        ),
+        (
+            "multipart/form-data; boundary = something ; 'boundary2=something_else' ; no_equals ",
+            (
+                "multipart/form-data",
+                {
+                    "boundary": "something",
+                    "boundary2": "something_else",
+                    "no_equals": True,
+                },
+            ),
+        ),
+        (
+            'multipart/form-data; boundary = something ; "boundary2=something_else" ; no_equals ',
+            (
+                "multipart/form-data",
+                {
+                    "boundary": "something",
+                    "boundary2": "something_else",
+                    "no_equals": True,
+                },
+            ),
+        ),
+        ("application/json ; ; ", ("application/json", {})),
+    ),
+)
+def test__parse_content_type_header(value, expected):
+    assert _parse_content_type_header(value) == expected
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    (
+        (CaseInsensitiveDict(), None),
+        (
+            CaseInsensitiveDict({"content-type": "application/json; charset=utf-8"}),
+            "utf-8",
+        ),
+        (CaseInsensitiveDict({"content-type": "text/plain"}), "ISO-8859-1"),
+    ),
+)
+def test_get_encoding_from_headers(value, expected):
+    assert get_encoding_from_headers(value) == expected
+
+
+@pytest.mark.parametrize(
+    "value, length",
+    (
+        ("", 0),
+        ("T", 1),
+        ("Test", 4),
+        ("Cont", 0),
+        ("Other", -5),
+        ("Content", None),
+    ),
+)
+def test_iter_slices(value, length):
+    if length is None or (length <= 0 and len(value) > 0):
+        # Reads all content at once
+        assert len(list(iter_slices(value, length))) == 1
+    else:
+        assert len(list(iter_slices(value, 1))) == length
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    (
+        (
+            '<http:/.../front.jpeg>; rel=front; type="image/jpeg"',
+            [{"url": "http:/.../front.jpeg", "rel": "front", "type": "image/jpeg"}],
+        ),
+        ("<http:/.../front.jpeg>", [{"url": "http:/.../front.jpeg"}]),
+        ("<http:/.../front.jpeg>;", [{"url": "http:/.../front.jpeg"}]),
+        (
+            '<http:/.../front.jpeg>; type="image/jpeg",<http://.../back.jpeg>;',
+            [
+                {"url": "http:/.../front.jpeg", "type": "image/jpeg"},
+                {"url": "http://.../back.jpeg"},
+            ],
+        ),
+        ("", []),
+    ),
+)
+def test_parse_header_links(value, expected):
+    assert parse_header_links(value) == expected
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    (
+        ("example.com/path", "http://example.com/path"),
+        ("//example.com/path", "http://example.com/path"),
+        ("example.com:80", "http://example.com:80"),
+        (
+            "http://user:pass@example.com/path?query",
+            "http://user:pass@example.com/path?query",
+        ),
+        ("http://user@example.com/path?query", "http://user@example.com/path?query"),
+    ),
+)
+def test_prepend_scheme_if_needed(value, expected):
+    assert prepend_scheme_if_needed(value, "http") == expected
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    (
+        ("T", "T"),
+        (b"T", "T"),
+        ("T", "T"),
+    ),
+)
+def test_to_native_string(value, expected):
+    assert to_native_string(value) == expected
+
+
+@pytest.mark.parametrize(
+    "url, expected",
+    (
+        ("http://u:p@example.com/path?a=1#test", "http://example.com/path?a=1"),
+        ("http://example.com/path", "http://example.com/path"),
+        ("//u:p@example.com/path", "//example.com/path"),
+        ("//example.com/path", "//example.com/path"),
+        ("example.com/path", "//example.com/path"),
+        ("scheme:u:p@example.com/path", "scheme://example.com/path"),
+    ),
+)
+def test_urldefragauth(url, expected):
+    assert urldefragauth(url) == expected
+
+
+@pytest.mark.parametrize(
+    "url, expected",
+    (
+        ("http://192.168.0.1:5000/", True),
+        ("http://192.168.0.1/", True),
+        ("http://172.16.1.1/", True),
+        ("http://172.16.1.1:5000/", True),
+        ("http://localhost.localdomain:5000/v1.0/", True),
+        ("http://google.com:6000/", True),
+        ("http://172.16.1.12/", False),
+        ("http://172.16.1.12:5000/", False),
+        ("http://google.com:5000/v1.0/", False),
+        ("file:///some/path/on/disk", True),
+    ),
+)
+def test_should_bypass_proxies(url, expected, monkeypatch):
+    """Tests for function should_bypass_proxies to check if proxy
+    can be bypassed or not
+    """
+    monkeypatch.setenv(
+        "no_proxy",
+        "192.168.0.0/24,127.0.0.1,localhost.localdomain,172.16.1.1, google.com:6000",
+    )
+    monkeypatch.setenv(
+        "NO_PROXY",
+        "192.168.0.0/24,127.0.0.1,localhost.localdomain,172.16.1.1, google.com:6000",
+    )
+    assert should_bypass_proxies(url, no_proxy=None) == expected
+
+
+@pytest.mark.parametrize(
+    "url, expected",
+    (
+        ("http://172.16.1.1/", "172.16.1.1"),
+        ("http://172.16.1.1:5000/", "172.16.1.1"),
+        ("http://user:pass@172.16.1.1", "172.16.1.1"),
+        ("http://user:pass@172.16.1.1:5000", "172.16.1.1"),
+        ("http://hostname/", "hostname"),
+        ("http://hostname:5000/", "hostname"),
+        ("http://user:pass@hostname", "hostname"),
+        ("http://user:pass@hostname:5000", "hostname"),
+    ),
+)
+def test_should_bypass_proxies_pass_only_hostname(url, expected):
+    """The proxy_bypass function should be called with a hostname or IP without
+    a port number or auth credentials.
+    """
+    with mock.patch("requests.utils.proxy_bypass") as proxy_bypass:
+        should_bypass_proxies(url, no_proxy=None)
+        proxy_bypass.assert_called_once_with(expected)
+
+
+@pytest.mark.parametrize(
+    "cookiejar",
+    (
+        compat.cookielib.CookieJar(),
+        RequestsCookieJar(),
+    ),
+)
+def test_add_dict_to_cookiejar(cookiejar):
+    """Ensure add_dict_to_cookiejar works for
+    non-RequestsCookieJar CookieJars
+    """
+    cookiedict = {"test": "cookies", "good": "cookies"}
+    cj = add_dict_to_cookiejar(cookiejar, cookiedict)
+    cookies = {cookie.name: cookie.value for cookie in cj}
+    assert cookiedict == cookies
+
+
+@pytest.mark.parametrize(
+    "value, expected",
+    (
+        ("test", True),
+        ("æíöû", False),
+        ("ジェーピーニック", False),
+    ),
+)
+def test_unicode_is_ascii(value, expected):
+    assert unicode_is_ascii(value) is expected
+
+
+@pytest.mark.parametrize(
+    "url, expected",
+    (
+        ("http://192.168.0.1:5000/", True),
+        ("http://192.168.0.1/", True),
+        ("http://172.16.1.1/", True),
+        ("http://172.16.1.1:5000/", True),
+        ("http://localhost.localdomain:5000/v1.0/", True),
+        ("http://172.16.1.12/", False),
+        ("http://172.16.1.12:5000/", False),
+        ("http://google.com:5000/v1.0/", False),
+    ),
+)
+def test_should_bypass_proxies_no_proxy(url, expected, monkeypatch):
+    """Tests for function should_bypass_proxies to check if proxy
+    can be bypassed or not using the 'no_proxy' argument
+    """
+    no_proxy = "192.168.0.0/24,127.0.0.1,localhost.localdomain,172.16.1.1"
+    # Test 'no_proxy' argument
+    assert should_bypass_proxies(url, no_proxy=no_proxy) == expected
+
+
+@pytest.mark.skipif(os.name != "nt", reason="Test only on Windows")
+@pytest.mark.parametrize(
+    "url, expected, override",
+    (
+        ("http://192.168.0.1:5000/", True, None),
+        ("http://192.168.0.1/", True, None),
+        ("http://172.16.1.1/", True, None),
+        ("http://172.16.1.1:5000/", True, None),
+        ("http://localhost.localdomain:5000/v1.0/", True, None),
+        ("http://172.16.1.22/", False, None),
+        ("http://172.16.1.22:5000/", False, None),
+        ("http://google.com:5000/v1.0/", False, None),
+        ("http://mylocalhostname:5000/v1.0/", True, "<local>"),
+        ("http://192.168.0.1/", False, ""),
+    ),
+)
+def test_should_bypass_proxies_win_registry(url, expected, override, monkeypatch):
+    """Tests for function should_bypass_proxies to check if proxy
+    can be bypassed or not with Windows registry settings
+    """
+    if override is None:
+        override = "192.168.*;127.0.0.1;localhost.localdomain;172.16.1.1"
+    import winreg
+
+    class RegHandle:
+        def Close(self):
+            pass
+
+    ie_settings = RegHandle()
+    proxyEnableValues = deque([1, "1"])
+
+    def OpenKey(key, subkey):
+        return ie_settings
+
+    def QueryValueEx(key, value_name):
+        if key is ie_settings:
+            if value_name == "ProxyEnable":
+                # this could be a string (REG_SZ) or a 32-bit number (REG_DWORD)
+                proxyEnableValues.rotate()
+                return [proxyEnableValues[0]]
+            elif value_name == "ProxyOverride":
+                return [override]
+
+    monkeypatch.setenv("http_proxy", "")
+    monkeypatch.setenv("https_proxy", "")
+    monkeypatch.setenv("ftp_proxy", "")
+    monkeypatch.setenv("no_proxy", "")
+    monkeypatch.setenv("NO_PROXY", "")
+    monkeypatch.setattr(winreg, "OpenKey", OpenKey)
+    monkeypatch.setattr(winreg, "QueryValueEx", QueryValueEx)
+    assert should_bypass_proxies(url, None) == expected
+
+
+@pytest.mark.skipif(os.name != "nt", reason="Test only on Windows")
+def test_should_bypass_proxies_win_registry_bad_values(monkeypatch):
+    """Tests for function should_bypass_proxies to check if proxy
+    can be bypassed or not with Windows invalid registry settings.
+    """
+    import winreg
+
+    class RegHandle:
+        def Close(self):
+            pass
+
+    ie_settings = RegHandle()
+
+    def OpenKey(key, subkey):
+        return ie_settings
+
+    def QueryValueEx(key, value_name):
+        if key is ie_settings:
+            if value_name == "ProxyEnable":
+                # Invalid response; Should be an int or int-y value
+                return [""]
+            elif value_name == "ProxyOverride":
+                return ["192.168.*;127.0.0.1;localhost.localdomain;172.16.1.1"]
+
+    monkeypatch.setenv("http_proxy", "")
+    monkeypatch.setenv("https_proxy", "")
+    monkeypatch.setenv("no_proxy", "")
+    monkeypatch.setenv("NO_PROXY", "")
+    monkeypatch.setattr(winreg, "OpenKey", OpenKey)
+    monkeypatch.setattr(winreg, "QueryValueEx", QueryValueEx)
+    assert should_bypass_proxies("http://172.16.1.1/", None) is False
+
+
+@pytest.mark.parametrize(
+    "env_name, value",
+    (
+        ("no_proxy", "192.168.0.0/24,127.0.0.1,localhost.localdomain"),
+        ("no_proxy", None),
+        ("a_new_key", "192.168.0.0/24,127.0.0.1,localhost.localdomain"),
+        ("a_new_key", None),
+    ),
+)
+def test_set_environ(env_name, value):
+    """Tests set_environ will set environ values and will restore the environ."""
+    environ_copy = copy.deepcopy(os.environ)
+    with set_environ(env_name, value):
+        assert os.environ.get(env_name) == value
+
+    assert os.environ == environ_copy
+
+
+def test_set_environ_raises_exception():
+    """Tests set_environ will raise exceptions in context when the
+    value parameter is None."""
+    with pytest.raises(Exception) as exception:
+        with set_environ("test1", None):
+            raise Exception("Expected exception")
+
+    assert "Expected exception" in str(exception.value)
+
+
+@pytest.mark.skipif(os.name != "nt", reason="Test only on Windows")
+def test_should_bypass_proxies_win_registry_ProxyOverride_value(monkeypatch):
+    """Tests for function should_bypass_proxies to check if proxy
+    can be bypassed or not with Windows ProxyOverride registry value ending with a semicolon.
+    """
+    import winreg
+
+    class RegHandle:
+        def Close(self):
+            pass
+
+    ie_settings = RegHandle()
+
+    def OpenKey(key, subkey):
+        return ie_settings
+
+    def QueryValueEx(key, value_name):
+        if key is ie_settings:
+            if value_name == "ProxyEnable":
+                return [1]
+            elif value_name == "ProxyOverride":
+                return [
+                    "192.168.*;127.0.0.1;localhost.localdomain;172.16.1.1;<-loopback>;"
+                ]
+
+    monkeypatch.setenv("NO_PROXY", "")
+    monkeypatch.setenv("no_proxy", "")
+    monkeypatch.setattr(winreg, "OpenKey", OpenKey)
+    monkeypatch.setattr(winreg, "QueryValueEx", QueryValueEx)
+    assert should_bypass_proxies("http://example.com/", None) is False

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/testserver/server.py

@@ -0,0 +1,176 @@
+import select
+import socket
+import ssl
+import threading
+
+
+def consume_socket_content(sock, timeout=0.5):
+    chunks = 65536
+    content = b""
+
+    while True:
+        more_to_read = select.select([sock], [], [], timeout)[0]
+        if not more_to_read:
+            break
+
+        new_content = sock.recv(chunks)
+        if not new_content:
+            break
+
+        content += new_content
+
+    return content
+
+
+class Server(threading.Thread):
+    """Dummy server using for unit testing"""
+
+    WAIT_EVENT_TIMEOUT = 5
+
+    def __init__(
+        self,
+        handler=None,
+        host="localhost",
+        port=0,
+        requests_to_handle=1,
+        wait_to_close_event=None,
+    ):
+        super().__init__()
+
+        self.handler = handler or consume_socket_content
+        self.handler_results = []
+
+        self.host = host
+        self.port = port
+        self.requests_to_handle = requests_to_handle
+
+        self.wait_to_close_event = wait_to_close_event
+        self.ready_event = threading.Event()
+        self.stop_event = threading.Event()
+
+    @classmethod
+    def text_response_server(cls, text, request_timeout=0.5, **kwargs):
+        def text_response_handler(sock):
+            request_content = consume_socket_content(sock, timeout=request_timeout)
+            sock.send(text.encode("utf-8"))
+
+            return request_content
+
+        return Server(text_response_handler, **kwargs)
+
+    @classmethod
+    def basic_response_server(cls, **kwargs):
+        return cls.text_response_server(
+            "HTTP/1.1 200 OK\r\n" + "Content-Length: 0\r\n\r\n", **kwargs
+        )
+
+    def run(self):
+        try:
+            self.server_sock = self._create_socket_and_bind()
+            # in case self.port = 0
+            self.port = self.server_sock.getsockname()[1]
+            self.ready_event.set()
+            self._handle_requests()
+
+            if self.wait_to_close_event:
+                self.wait_to_close_event.wait(self.WAIT_EVENT_TIMEOUT)
+        finally:
+            self.ready_event.set()  # just in case of exception
+            self._close_server_sock_ignore_errors()
+            self.stop_event.set()
+
+    def _create_socket_and_bind(self):
+        sock = socket.socket()
+        sock.bind((self.host, self.port))
+        sock.listen()
+        return sock
+
+    def _close_server_sock_ignore_errors(self):
+        try:
+            self.server_sock.close()
+        except OSError:
+            pass
+
+    def _handle_requests(self):
+        for _ in range(self.requests_to_handle):
+            sock = self._accept_connection()
+            if not sock:
+                break
+
+            handler_result = self.handler(sock)
+
+            self.handler_results.append(handler_result)
+            sock.close()
+
+    def _accept_connection(self):
+        try:
+            ready, _, _ = select.select(
+                [self.server_sock], [], [], self.WAIT_EVENT_TIMEOUT
+            )
+            if not ready:
+                return None
+
+            return self.server_sock.accept()[0]
+        except OSError:
+            return None
+
+    def __enter__(self):
+        self.start()
+        if not self.ready_event.wait(self.WAIT_EVENT_TIMEOUT):
+            raise RuntimeError("Timeout waiting for server to be ready.")
+        return self.host, self.port
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        if exc_type is None:
+            self.stop_event.wait(self.WAIT_EVENT_TIMEOUT)
+        else:
+            if self.wait_to_close_event:
+                # avoid server from waiting for event timeouts
+                # if an exception is found in the main thread
+                self.wait_to_close_event.set()
+
+        # ensure server thread doesn't get stuck waiting for connections
+        self._close_server_sock_ignore_errors()
+        self.join()
+        return False  # allow exceptions to propagate
+
+
+class TLSServer(Server):
+    def __init__(
+        self,
+        *,
+        handler=None,
+        host="localhost",
+        port=0,
+        requests_to_handle=1,
+        wait_to_close_event=None,
+        cert_chain=None,
+        keyfile=None,
+        mutual_tls=False,
+        cacert=None,
+    ):
+        super().__init__(
+            handler=handler,
+            host=host,
+            port=port,
+            requests_to_handle=requests_to_handle,
+            wait_to_close_event=wait_to_close_event,
+        )
+        self.cert_chain = cert_chain
+        self.keyfile = keyfile
+        self.ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        self.ssl_context.load_cert_chain(self.cert_chain, keyfile=self.keyfile)
+        self.mutual_tls = mutual_tls
+        self.cacert = cacert
+        if mutual_tls:
+            # For simplicity, we're going to assume that the client cert is
+            # issued by the same CA as our Server certificate
+            self.ssl_context.verify_mode = ssl.CERT_OPTIONAL
+            self.ssl_context.load_verify_locations(self.cacert)
+
+    def _create_socket_and_bind(self):
+        sock = socket.socket()
+        sock = self.ssl_context.wrap_socket(sock, server_side=True)
+        sock.bind((self.host, self.port))
+        sock.listen()
+        return sock

gcloud auth application-default login/google-cloud-sdk/platform/gsutil/third_party/requests/tests/utils.py

@@ -0,0 +1,17 @@
+import contextlib
+import os
+
+
+@contextlib.contextmanager
+def override_environ(**kwargs):
+    save_env = dict(os.environ)
+    for key, value in kwargs.items():
+        if value is None:
+            del os.environ[key]
+        else:
+            os.environ[key] = value
+    try:
+        yield
+    finally:
+        os.environ.clear()
+        os.environ.update(save_env)