feat(gapic): support mTLS certificates when available (#1566)

chore: librarian update image pull request: 20251216T203515Z

Author: parthea

.librarian/generator-input/owlbot.py .librarian/generator-input/librarian.py.librarian/generator-input/owlbot.py renamed to .librarian/generator-input/librarian.py

@@ -98,7 +98,6 @@
 install_requires=dependencies,
 extras_require=extras,
 python_requires=">=3.7",
-scripts=["scripts/fixup_pubsub_v1_keywords.py"],
 include_package_data=True,
 zip_safe=False,
 )

.librarian/generator-input/setup.py

@@ -1,4 +1,4 @@
-image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:ce48ed695c727f7e13efd1fd68f466a55a0d772c87b69158720cec39965bc8b2
+image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:b8058df4c45e9a6e07f6b4d65b458d0d059241dd34c814f151c8bf6b89211209
 libraries:
  - id: google-cloud-pubsub
 version: 2.33.0

.librarian/state.yaml

@@ -15,8 +15,18 @@
 #
 fromgoogle.pubsub_v1importgapic_versionaspackage_version
 
+importgoogle.api_coreasapi_core
+importsys
+
 __version__=package_version.__version__
 
+ifsys.version_info>= (3, 8): # pragma: NO COVER
+fromimportlibimportmetadata
+else: # pragma: NO COVER
+# TODO(https://github.com/googleapis/python-api-core/issues/835): Remove
+# this code path once we drop support for Python 3.7
+importimportlib_metadataasmetadata
+
 
 from .services.publisherimportPublisherClient
 from .services.publisherimportPublisherAsyncClient
@@ -94,6 +104,100 @@
 from .types.schemaimportEncoding
 from .types.schemaimportSchemaView
 
+ifhasattr(api_core, "check_python_version") andhasattr(
+api_core, "check_dependency_versions"
+): # pragma: NO COVER
+api_core.check_python_version("google.pubsub_v1") # type: ignore
+api_core.check_dependency_versions("google.pubsub_v1") # type: ignore
+else: # pragma: NO COVER
+# An older version of api_core is installed which does not define the
+# functions above. We do equivalent checks manually.
+try:
+importwarnings
+importsys
+
+_py_version_str=sys.version.split()[0]
+_package_label="google.pubsub_v1"
+ifsys.version_info< (3, 9):
+warnings.warn(
+"You are using a non-supported Python version "
++f"({_py_version_str}). Google will not post any further "
++f"updates to {_package_label} supporting this Python version. "
++"Please upgrade to the latest Python version, or at "
++f"least to Python 3.9, and then update {_package_label}.",
+FutureWarning,
+ )
+ifsys.version_info[:2] == (3, 9):
+warnings.warn(
+f"You are using a Python version ({_py_version_str}) "
++f"which Google will stop supporting in {_package_label} in "
++"January 2026. Please "
++"upgrade to the latest Python version, or at "
++"least to Python 3.10, before then, and "
++f"then update {_package_label}.",
+FutureWarning,
+ )
+
+defparse_version_to_tuple(version_string: str):
+"""Safely converts a semantic version string to a comparable tuple of integers.
+ Example: "4.25.8" -> (4, 25, 8)
+ Ignores non-numeric parts and handles common version formats.
+ Args:
+ version_string: Version string in the format "x.y.z" or "x.y.z<suffix>"
+ Returns:
+ Tuple of integers for the parsed version string.
+ """
+parts= []
+forpartinversion_string.split("."):
+try:
+parts.append(int(part))
+exceptValueError:
+# If it's a non-numeric part (e.g., '1.0.0b1' -> 'b1'), stop here.
+# This is a simplification compared to 'packaging.parse_version', but sufficient
+# for comparing strictly numeric semantic versions.
+break
+returntuple(parts)
+
+def_get_version(dependency_name):
+try:
+version_string: str=metadata.version(dependency_name)
+parsed_version=parse_version_to_tuple(version_string)
+return (parsed_version, version_string)
+exceptException:
+# Catch exceptions from metadata.version() (e.g., PackageNotFoundError)
+# or errors during parse_version_to_tuple
+return (None, "--")
+
+_dependency_package="google.protobuf"
+_next_supported_version="4.25.8"
+_next_supported_version_tuple= (4, 25, 8)
+_recommendation=" (we recommend 6.x)"
+ (_version_used, _version_used_string) =_get_version(_dependency_package)
+if_version_usedand_version_used<_next_supported_version_tuple:
+warnings.warn(
+f"Package {_package_label} depends on "
++f"{_dependency_package}, currently installed at version "
++f"{_version_used_string}. Future updates to "
++f"{_package_label} will require {_dependency_package} at "
++f"version {_next_supported_version} or higher{_recommendation}."
++" Please ensure "
++"that either (a) your Python environment doesn't pin the "
++f"version of {_dependency_package}, so that updates to "
++f"{_package_label} can require the higher version, or "
++"(b) you manually update your Python environment to use at "
++f"least version {_next_supported_version} of "
++f"{_dependency_package}.",
+FutureWarning,
+ )
+exceptException:
+warnings.warn(
+"Could not determine the version of Python "
++"currently being used. To continue receiving "
++"updates for {_package_label}, ensure you are "
++"using a supported version of Python; see "
++"https://devguide.python.org/versions/"
+ )
+
 __all__= (
 "PublisherAsyncClient",
 "SchemaServiceAsyncClient",

google/pubsub_v1/__init__.py

@@ -168,6 +168,34 @@ def _get_default_mtls_endpoint(api_endpoint):
 _DEFAULT_ENDPOINT_TEMPLATE="pubsub.{UNIVERSE_DOMAIN}"
 _DEFAULT_UNIVERSE="googleapis.com"
 
+@staticmethod
+def_use_client_cert_effective():
+"""Returns whether client certificate should be used for mTLS if the
+ google-auth version supports should_use_client_cert automatic mTLS enablement.
+
+ Alternatively, read from the GOOGLE_API_USE_CLIENT_CERTIFICATE env var.
+
+ Returns:
+ bool: whether client certificate should be used for mTLS
+ Raises:
+ ValueError: (If using a version of google-auth without should_use_client_cert and
+ GOOGLE_API_USE_CLIENT_CERTIFICATE is set to an unexpected value.)
+ """
+# check if google-auth version supports should_use_client_cert for automatic mTLS enablement
+ifhasattr(mtls, "should_use_client_cert"): # pragma: NO COVER
+returnmtls.should_use_client_cert()
+else: # pragma: NO COVER
+# if unsupported, fallback to reading from env var
+use_client_cert_str=os.getenv(
+"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
+ ).lower()
+ifuse_client_cert_strnotin ("true", "false"):
+raiseValueError(
+"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be"
+" either `true` or `false`"
+ )
+returnuse_client_cert_str=="true"
+
 @classmethod
 deffrom_service_account_info(cls, info: dict, *args, **kwargs):
 """Creates an instance of this client using the provided credentials
@@ -427,20 +455,16 @@ def get_mtls_endpoint_and_cert_source(
  )
 ifclient_optionsisNone:
 client_options=client_options_lib.ClientOptions()
-use_client_cert=os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false")
+use_client_cert=PublisherClient._use_client_cert_effective()
 use_mtls_endpoint=os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")
-ifuse_client_certnotin ("true", "false"):
-raiseValueError(
-"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
- )
 ifuse_mtls_endpointnotin ("auto", "never", "always"):
 raiseMutualTLSChannelError(
 "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
  )
 
 # Figure out the client cert source to use.
 client_cert_source=None
-ifuse_client_cert=="true":
+ifuse_client_cert:
 ifclient_options.client_cert_source:
 client_cert_source=client_options.client_cert_source
 elifmtls.has_default_client_cert_source():
@@ -472,20 +496,14 @@ def _read_environment_variables():
  google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT
  is not any of ["auto", "never", "always"].
  """
-use_client_cert=os.getenv(
-"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
- ).lower()
+use_client_cert=PublisherClient._use_client_cert_effective()
 use_mtls_endpoint=os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()
 universe_domain_env=os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")
-ifuse_client_certnotin ("true", "false"):
-raiseValueError(
-"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
- )
 ifuse_mtls_endpointnotin ("auto", "never", "always"):
 raiseMutualTLSChannelError(
 "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
  )
-returnuse_client_cert=="true", use_mtls_endpoint, universe_domain_env
+returnuse_client_cert, use_mtls_endpoint, universe_domain_env
 
 @staticmethod
 def_get_client_cert_source(provided_cert_source, use_cert_flag):

google/pubsub_v1/services/publisher/client.py

@@ -153,6 +153,34 @@ def _get_default_mtls_endpoint(api_endpoint):
 _DEFAULT_ENDPOINT_TEMPLATE="pubsub.{UNIVERSE_DOMAIN}"
 _DEFAULT_UNIVERSE="googleapis.com"
 
+@staticmethod
+def_use_client_cert_effective():
+"""Returns whether client certificate should be used for mTLS if the
+ google-auth version supports should_use_client_cert automatic mTLS enablement.
+
+ Alternatively, read from the GOOGLE_API_USE_CLIENT_CERTIFICATE env var.
+
+ Returns:
+ bool: whether client certificate should be used for mTLS
+ Raises:
+ ValueError: (If using a version of google-auth without should_use_client_cert and
+ GOOGLE_API_USE_CLIENT_CERTIFICATE is set to an unexpected value.)
+ """
+# check if google-auth version supports should_use_client_cert for automatic mTLS enablement
+ifhasattr(mtls, "should_use_client_cert"): # pragma: NO COVER
+returnmtls.should_use_client_cert()
+else: # pragma: NO COVER
+# if unsupported, fallback to reading from env var
+use_client_cert_str=os.getenv(
+"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
+ ).lower()
+ifuse_client_cert_strnotin ("true", "false"):
+raiseValueError(
+"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be"
+" either `true` or `false`"
+ )
+returnuse_client_cert_str=="true"
+
 @classmethod
 deffrom_service_account_info(cls, info: dict, *args, **kwargs):
 """Creates an instance of this client using the provided credentials
@@ -335,20 +363,16 @@ def get_mtls_endpoint_and_cert_source(
  )
 ifclient_optionsisNone:
 client_options=client_options_lib.ClientOptions()
-use_client_cert=os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false")
+use_client_cert=SchemaServiceClient._use_client_cert_effective()
 use_mtls_endpoint=os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")
-ifuse_client_certnotin ("true", "false"):
-raiseValueError(
-"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
- )
 ifuse_mtls_endpointnotin ("auto", "never", "always"):
 raiseMutualTLSChannelError(
 "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
  )
 
 # Figure out the client cert source to use.
 client_cert_source=None
-ifuse_client_cert=="true":
+ifuse_client_cert:
 ifclient_options.client_cert_source:
 client_cert_source=client_options.client_cert_source
 elifmtls.has_default_client_cert_source():
@@ -380,20 +404,14 @@ def _read_environment_variables():
  google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT
  is not any of ["auto", "never", "always"].
  """
-use_client_cert=os.getenv(
-"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
- ).lower()
+use_client_cert=SchemaServiceClient._use_client_cert_effective()
 use_mtls_endpoint=os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()
 universe_domain_env=os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")
-ifuse_client_certnotin ("true", "false"):
-raiseValueError(
-"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
- )
 ifuse_mtls_endpointnotin ("auto", "never", "always"):
 raiseMutualTLSChannelError(
 "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
  )
-returnuse_client_cert=="true", use_mtls_endpoint, universe_domain_env
+returnuse_client_cert, use_mtls_endpoint, universe_domain_env
 
 @staticmethod
 def_get_client_cert_source(provided_cert_source, use_cert_flag):

google/pubsub_v1/services/schema_service/client.py

@@ -172,6 +172,34 @@ def _get_default_mtls_endpoint(api_endpoint):
 _DEFAULT_ENDPOINT_TEMPLATE="pubsub.{UNIVERSE_DOMAIN}"
 _DEFAULT_UNIVERSE="googleapis.com"
 
+@staticmethod
+def_use_client_cert_effective():
+"""Returns whether client certificate should be used for mTLS if the
+ google-auth version supports should_use_client_cert automatic mTLS enablement.
+
+ Alternatively, read from the GOOGLE_API_USE_CLIENT_CERTIFICATE env var.
+
+ Returns:
+ bool: whether client certificate should be used for mTLS
+ Raises:
+ ValueError: (If using a version of google-auth without should_use_client_cert and
+ GOOGLE_API_USE_CLIENT_CERTIFICATE is set to an unexpected value.)
+ """
+# check if google-auth version supports should_use_client_cert for automatic mTLS enablement
+ifhasattr(mtls, "should_use_client_cert"): # pragma: NO COVER
+returnmtls.should_use_client_cert()
+else: # pragma: NO COVER
+# if unsupported, fallback to reading from env var
+use_client_cert_str=os.getenv(
+"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
+ ).lower()
+ifuse_client_cert_strnotin ("true", "false"):
+raiseValueError(
+"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be"
+" either `true` or `false`"
+ )
+returnuse_client_cert_str=="true"
+
 @classmethod
 deffrom_service_account_info(cls, info: dict, *args, **kwargs):
 """Creates an instance of this client using the provided credentials
@@ -414,20 +442,16 @@ def get_mtls_endpoint_and_cert_source(
  )
 ifclient_optionsisNone:
 client_options=client_options_lib.ClientOptions()
-use_client_cert=os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "false")
+use_client_cert=SubscriberClient._use_client_cert_effective()
 use_mtls_endpoint=os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")
-ifuse_client_certnotin ("true", "false"):
-raiseValueError(
-"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
- )
 ifuse_mtls_endpointnotin ("auto", "never", "always"):
 raiseMutualTLSChannelError(
 "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
  )
 
 # Figure out the client cert source to use.
 client_cert_source=None
-ifuse_client_cert=="true":
+ifuse_client_cert:
 ifclient_options.client_cert_source:
 client_cert_source=client_options.client_cert_source
 elifmtls.has_default_client_cert_source():
@@ -459,20 +483,14 @@ def _read_environment_variables():
  google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT
  is not any of ["auto", "never", "always"].
  """
-use_client_cert=os.getenv(
-"GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
- ).lower()
+use_client_cert=SubscriberClient._use_client_cert_effective()
 use_mtls_endpoint=os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()
 universe_domain_env=os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")
-ifuse_client_certnotin ("true", "false"):
-raiseValueError(
-"Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be either `true` or `false`"
- )
 ifuse_mtls_endpointnotin ("auto", "never", "always"):
 raiseMutualTLSChannelError(
 "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
  )
-returnuse_client_cert=="true", use_mtls_endpoint, universe_domain_env
+returnuse_client_cert, use_mtls_endpoint, universe_domain_env
 
 @staticmethod
 def_get_client_cert_source(provided_cert_source, use_cert_flag):

google/pubsub_v1/services/subscriber/client.py

@@ -14,6 +14,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# DO NOT EDIT THIS FILE OUTSIDE OF `.librarian/generator-input`
+# The source of truth for this file is `.librarian/generator-input`
+
+
 # Generated by synthtool. DO NOT EDIT!
 
 from __future__ importabsolute_import