gam7 7.6.5__tar.gz → 7.6.8__tar.gz

gam7-7.6.8/.github/actions/decrypt.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+credspath="$1"
+if [ ! -d "$credspath" ]; then
+    echo "creating ${credspath}"
+    mkdir -p "$credspath"
+fi
+credsfile="${credspath}/oauth2.txt"
+echo "$oa2" > "$credsfile"
+echo "File size:"
+wc -c "$credsfile"
+echo "File type:"
+file "$credsfile"
+echo "Validation:"
+jq -e . "$credsfile" > /dev/null
+if [ $? -eq 0 ]; then
+  echo "Valid JSON"
+else
+  echo "Invalid JSON"
+fi

{gam7-7.6.5 → gam7-7.6.8}/.github/workflows/build.yml

@@ -39,76 +39,69 @@ jobs:
           - os: ubuntu-22.04
             jid: 1
             goal: build
-            arch: x86_64
-            openssl_archs: linux-x86_64
+            name: Build Intel Ubuntu Jammy
           - os: ubuntu-24.04
             jid: 2
             goal: build
-            arch: x86_64
-            openssl_archs: linux-x86_64
+            name: Build Intel Ubuntu Noble
           - os: ubuntu-24.04-arm
             jid: 3
             goal: build
-            arch: aarch64
-            openssl_archs: linux-aarch64
+            name: Build Arm Ubuntu Noble
           - os: ubuntu-22.04-arm
             jid: 4
             goal: build
-            arch: aarch64
-            openssl_archs: linux-aarch64
+            name: Build Arm Ubuntu Jammy
           - os: ubuntu-22.04
             jid: 5
             goal: build
-            arch: x86_64
-            openssl_archs: linux-x86_64
             staticx: yes
+            name: Build Intel StaticX Legacy
           - os: ubuntu-22.04-arm
             jid: 6
             goal: build
-            arch: aarch64
-            openssl_archs: linux-aarch64
             staticx: yes
+            name: Build Arm StaticX Legacy
           - os: macos-13
             jid: 7
             goal: build
-            arch: x86_64
-            openssl_archs: darwin64-x86_64
+            name: Build Intel MacOS
           - os: macos-14
             jid: 8
             goal: build
-            arch: aarch64
-            openssl_archs: darwin64-arm64
+            name: Build Arm MacOS 14
           - os: macos-15
             jid: 9
             goal: build
-            arch: aarch64
-            openssl_archs: darwin64-arm64
+            name: Build Arm MacOS 15
           - os: windows-2022
             jid: 10
             goal: build
-            arch: Win64
-            openssl_archs: VC-WIN64A
-          #- os: windows-11-arm
-          #  jid: 14
-          #  goal: build
-          #  arch: arm64
-          #  openssl_archs: VC-WIN64-ARM
-          #  continue-on-error: true
+            name: Build Intel Windows
+          - os: windows-11-arm
+            jid: 11
+            goal: build
+            name: Build Arm Windows
           - os: ubuntu-24.04
             goal: test
             python: "3.10"
-            jid: 11
-            arch: x86_64
+            jid: 12
+            name: Test Python 3.10
           - os: ubuntu-24.04
             goal: test
             python: "3.11"
-            jid: 12
-            arch: x86_64
+            jid: 13
+            name: Test Python 3.11
           - os: ubuntu-24.04
             goal: test
             python: "3.12"
-            jid: 13
-            arch: x86_64
+            jid: 14
+            name: Test Python 3.12
+          - os: ubuntu-24.04
+            goal: test
+            python: "3.14-dev"
+            jid: 15
+            name: Test Python 3.14-dev
 
     steps:
 
@@ -131,7 +124,7 @@ jobs:
         with:
           path: |
             cache.tar.xz
-          key: gam-${{ matrix.jid }}-20250408-01
+          key: gam-${{ matrix.jid }}-20250422
 
       - name: Untar Cache archive
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit == 'true'
@@ -149,12 +142,21 @@ jobs:
 
       - name: common variables for all runs
         env:
-          arch: ${{ matrix.arch }}
           JID: ${{ matrix.jid }}
           ACTIONS_CACHE: ${{ steps.cache-python-ssl.outputs.cache-hit }}
           ACTIONS_GOAL: ${{ matrix.goal }}
         run: |
-          echo "arch=${arch}" >> $GITHUB_ENV
+          case $RUNNER_ARCH in
+            X64)
+              echo "arch=x86_64" >> $GITHUB_ENV
+              ;;
+            ARM64)
+              echo "arch=arm64" >> $GITHUB_ENV
+              ;;
+            *)
+              echo "arch=${RUNNER_ARCH}" >> $GITHUB_ENV
+              ;;
+          esac 
           echo "JID=${JID}" >> $GITHUB_ENV
           echo "ACTIONS_CACHE=${ACTIONS_CACHE}" >> $GITHUB_ENV
           echo "ACTIONS_GOAL=${ACTIONS_GOAL}" >> $GITHUB_ENV
@@ -168,7 +170,7 @@ jobs:
           echo "curl_retry=${curl_retry}" >> $GITHUB_ENV
           # GAMCFGDIR should be recreated on every run
           GAMCFGDIR="${RUNNER_TEMP}/.gam"
-          if [ "$arch" == "Win64" ]; then
+          if [ "$RUNNER_OS" == "Windows" ]; then
             GAMCFGDIR=$(cygpath -u "$GAMCFGDIR")
           fi
           echo "GAMCFGDIR=${GAMCFGDIR}" >> $GITHUB_ENV
@@ -227,7 +229,6 @@ jobs:
       - name: Set Env Variables for build
         if: matrix.goal == 'build'
         env:
-          openssl_archs: ${{ matrix.openssl_archs }}
           staticx: ${{ matrix.staticx }}
         run: |
           echo "We are running on ${RUNNER_OS}"
@@ -251,18 +252,15 @@ jobs:
             PERL="c:\strawberry\perl\bin\perl.exe"
             if [[ "$RUNNER_ARCH" == "ARM64" ]]; then
               PYEXTERNALS_PATH="arm64"
-              GAM_ARCHIVE_ARCH="arm64"
               WIX_ARCH="arm64"
               CHOC_OPS=""
             elif [[ "$RUNNER_ARCH" == "X64" ]]; then
               PYEXTERNALS_PATH="amd64"
-              GAM_ARCHIVE_ARCH="x86_64"
               WIX_ARCH="x64"
               CHOC_OPS=""
             fi
             LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:${PYTHON_SOURCE_PATH}/PCbuild/${PYEXTERNALS_PATH}"
             echo "PYTHON=${PYTHON_SOURCE_PATH}/PCbuild/${PYEXTERNALS_PATH}/python.exe" >> $GITHUB_ENV
-            echo "GAM_ARCHIVE_ARCH=${GAM_ARCHIVE_ARCH}" >> $GITHUB_ENV
             echo "WIX_ARCH=${WIX_ARCH}" >> $GITHUB_ENV
           fi
           echo "We'll run make with: ${MAKEOPT}"
@@ -272,7 +270,6 @@ jobs:
           echo "MAKEOPT=${MAKEOPT}" >> $GITHUB_ENV
           echo "PERL=${PERL}" >> $GITHUB_ENV
           echo "PYEXTERNALS_PATH=${PYEXTERNALS_PATH}" >> $GITHUB_ENV
-          echo "openssl_archs=${openssl_archs}" >> $GITHUB_ENV
 
       - name: Get latest stable OpenSSL source
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit != 'true'
@@ -300,7 +297,7 @@ jobs:
             export CFLAGS=-DNO_INTERLOCKEDOR64
           fi
           # --libdir=lib is needed so Python can find OpenSSL libraries
-          "${PERL}" ./Configure "${openssl_arch}" --libdir=lib --prefix="${OPENSSL_INSTALL_PATH}" $OPENSSL_CONFIG_OPTS
+          "${PERL}" ./Configure --libdir=lib --prefix="${OPENSSL_INSTALL_PATH}" $OPENSSL_CONFIG_OPTS
 
       - name: Rename GNU link on Windows
         if: matrix.goal == 'build' && runner.os == 'Windows' && steps.cache-python-ssl.outputs.cache-hit != 'true'
@@ -323,11 +320,10 @@ jobs:
         run: |
           cd "${OPENSSL_SOURCE_PATH}"
           # install_sw saves us ages processing man pages :-)
-          # $MAKE install_sw
-          $MAKE install
-          #if [[ "${RUNNER_OS}" != "Windows" ]]; then
-          echo "LDFLAGS=-L${OPENSSL_INSTALL_PATH}/lib" >> $GITHUB_ENV
-          #fi
+          $MAKE install_sw
+          if [[ "${RUNNER_OS}" != "Windows" ]]; then
+            echo "LDFLAGS=-L${OPENSSL_INSTALL_PATH}/lib" >> $GITHUB_ENV
+          fi
           echo "CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1" >> $GITHUB_ENV
           case $RUNNER_ARCH in
             X64)
@@ -447,31 +443,36 @@ jobs:
           "${PYTHON}" -V
           "${PYTHON}" -c "import ssl; print(f'Using {ssl.OPENSSL_VERSION}')"
 
-      - name: Windows ARM Install rust and cargo
-        if: matrix.goal == 'build' && runner.os == 'Windows' && runner.arch == 'ARM64' && steps.cache-python-ssl.outputs.cache-hit != 'true'
-        run: |
-          choco install rust
-
       - name: Upgrade pip, wheel, etc
         run: |
           curl $curl_retry -O https://bootstrap.pypa.io/get-pip.py
-          "${PYTHON}" get-pip.py
-          "${PYTHON}" -m pip install --upgrade pip
-          "${PYTHON}" -m pip install --upgrade wheel
-          "${PYTHON}" -m pip install --upgrade setuptools
-
+          "$PYTHON" get-pip.py
+          "$PYTHON" -m pip install --upgrade pip
+          "$PYTHON" -m pip install --upgrade wheel
+          "$PYTHON" -m pip install --upgrade setuptools
+
+      - name: Custom wheels for Win arm64
+        if: runner.os == 'Windows' && runner.arch == 'ARM64'
+        run: |
+          latest_lxml_whl=$(curl https://api.github.com/repos/GAM-team/lxml-wheel/releases/latest -s | jq -r .assets.[0].browser_download_url)
+          echo "Downloading ${latest_lxml_whl}..."
+          curl -O -L "$latest_lxml_whl"
+          "$PYTHON" -m pip install lxml*.whl
+          latest_crypt_whl=$(curl https://api.github.com/repos/jay0lee/cryptography/releases/latest -s | jq -r .assets.[0].browser_download_url)
+          echo "Downloading ${latest_crypt_whl}..."
+          curl -O -L "$latest_crypt_whl"
+          "$PYTHON" -m pip install cryptography*.whl
+          
       - name: Install pip requirements
         run: |
-          # rust cargo needs this to compile
-          export OPENSSL_DIR="$OPENSSL_INSTALL_PATH"
           echo "before anything..."
-          "${PYTHON}" -m pip list
-          "${PYTHON}" -m pip install --upgrade -r requirements.txt
+          "$PYTHON" -m pip list
+          "$PYTHON" -m pip install --upgrade -r requirements.txt
           echo "after requirements..."
-          "${PYTHON}" -m pip list
-          "${PYTHON}" -m pip install --force-reinstall --no-deps --upgrade cryptography
+          "$PYTHON" -m pip list
+          #"$PYTHON" -m pip install --force-reinstall --no-deps --upgrade cryptography
           echo "after everything..."
-          "${PYTHON}" -m pip list
+          "$PYTHON" -m pip list
 
       - name: Install PyInstaller
         if: matrix.goal == 'build'
@@ -595,14 +596,12 @@ jobs:
           echo "GAM Version ${GAMVERSION}"
           echo "GAMVERSION=${GAMVERSION}" >> $GITHUB_ENV
 
-      - name: Configure service account auth
+      - name: Configure user and service account auth
         id: configserviceaccount
         env:
-          PASSCODE: ${{ secrets.PASSCODE }}
+          oa2: ${{ secrets[format('GAM_GHA_{0}', matrix.jid)] }}
         run: |
-          source ../.github/actions/decrypt.sh ../.github/actions/creds.tar.xz.gpg creds.tar.xz "${GAMCFGDIR}"
-          mv -v "${GAMCFGDIR}/oauth2.txt-gam-gha-${JID}" "${GAMCFGDIR}/oauth2.txt"
-          rm -v $GAMCFGDIR/oauth2.txt-gam*
+          ../.github/actions/decrypt.sh "${GAMCFGDIR}"
           $gam create signjwtserviceaccount
 
       - name: Upload gam.exe Windows for signing
@@ -650,22 +649,29 @@ jobs:
             else
               libver="glibc$(ldd --version | awk '/ldd/{print $NF}')"
             fi
-            GAM_ARCHIVE="${GITHUB_WORKSPACE}/gam-${GAMVERSION}-linux-$(arch)-${libver}.tar.xz"
+            GAM_ARCHIVE="${GITHUB_WORKSPACE}/gam-${GAMVERSION}-linux-${arch}-${libver}.tar.xz"
           fi
           echo "GAM Archive ${GAM_ARCHIVE}"
           tar -C "${gampath}/.." --create --verbose --exclude-from "${GITHUB_WORKSPACE}/.github/actions/package_exclusions.txt" --file $GAM_ARCHIVE --xz gam7
 
-      - name: Windows package
+      - name: Install Wix on Win ARM64
+        if: runner.os == 'Windows' && runner.arch == 'ARM64'
+        run: |
+          choco install wixtoolset
+
+      - name: Windows package zip
         if: runner.os == 'Windows' && matrix.goal != 'test'
         run: |
           echo "started in $(pwd)"
           cd "${gampath}/.."
           echo "moved to $(pwd)"
-          GAM_ARCHIVE="${GITHUB_WORKSPACE}/gam-${GAMVERSION}-windows-${GAM_ARCHIVE_ARCH}.zip"
+          GAM_ARCHIVE="${GITHUB_WORKSPACE}/gam-${GAMVERSION}-windows-${arch}.zip"
           /c/Program\ Files/7-Zip/7z.exe a -tzip "$GAM_ARCHIVE" gam7 "-xr@${GITHUB_WORKSPACE}/.github/actions/package_exclusions.txt" -bb3
-          cd ../..
-          echo "moved to $(pwd)"
-          export MSI_FILENAME="${GITHUB_WORKSPACE}/gam-${GAMVERSION}-windows-${GAM_ARCHIVE_ARCH}.msi"
+
+      - name: Windows package MSI
+        if: runner.os == 'Windows' && matrix.goal != 'test'
+        run: |
+          export MSI_FILENAME="${GITHUB_WORKSPACE}/gam-${GAMVERSION}-windows-${arch}.msi"
           # auto-generate a lib.wxs based on the files PyInstaller created for the lib/ directory
           /c/Program\ Files\ \(x86\)/WiX\ Toolset\ v3.14/bin/heat.exe dir "${gampath}/lib" -ke -srd -cg Lib -gg -dr lib -directoryid lib -out lib.wxs
           $PYTHON tools/gen-wix-xml-filelist.py lib.wxs

{gam7-7.6.5 → gam7-7.6.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gam7
-Version: 7.6.5
+Version: 7.6.8
 Summary: CLI tool to manage Google Workspace
 Project-URL: Homepage, https://github.com/GAM-team/GAM
 Project-URL: Issues, https://github.com/GAM-team/GAM/issues
@@ -30,6 +30,7 @@ Requires-Dist: httplib2>=0.17.0
 Requires-Dist: lxml
 Requires-Dist: passlib>=1.7.2
 Requires-Dist: pathvalidate
+Requires-Dist: pyscard==2.2.1
 Requires-Dist: python-dateutil
 Provides-Extra: yubikey
 Requires-Dist: yubikey-manager>=5.0; extra == 'yubikey'

{gam7-7.6.5 → gam7-7.6.8}/pyproject.toml

@@ -20,6 +20,7 @@ dependencies = [
     "lxml",
     "passlib>=1.7.2",
     "pathvalidate",
+    "pyscard==2.2.1",
     "python-dateutil",
 ]
 description = "CLI tool to manage Google Workspace"

{gam7-7.6.5 → gam7-7.6.8}/src/GamUpdate.txt

@@ -1,3 +1,24 @@
+7.06.08
+
+Fixed problem where Yubikeys caused a trap.
+
+7.06.07
+
+Updated private key rotation progress messages in `gam create|use|update project`
+and `gam upload sakey`.
+
+Updated `gam use project` to display the following error message when the specifed project
+already has a service account.
+```
+Re-run the command specify a new service account name with: saname <ServiceAccountName>'
+```
+
+7.06.06
+
+Native support for Windows 11 Arm-based devices.
+
+Renamed some MacOS and Linux binary installer files to align on terminology. Everything is "arm64" now, no "aarch64".
+
 7.06.05
 
 Updated code in `gam delete|update chromepolicy` to handle the `policyTargetKey[additionalTargetKeys]`

{gam7-7.6.5 → gam7-7.6.8}/src/gam/__init__.py

@@ -25,7 +25,7 @@ https://github.com/GAM-team/GAM/wiki
 """
 
 __author__ = 'GAM Team <google-apps-manager@googlegroups.com>'
-__version__ = '7.06.05'
+__version__ = '7.06.08'
 __license__ = 'Apache License 2.0 (http://www.apache.org/licenses/LICENSE-2.0)'
 
 #pylint: disable=wrong-import-position
@@ -11384,25 +11384,26 @@ def _waitForSvcAcctCompletion(i):
     sys.stdout.write(Msg.WAITING_FOR_ITEM_CREATION_TO_COMPLETE_SLEEPING.format(Ent.Singular(Ent.SVCACCT), sleep_time))
   time.sleep(sleep_time)
 
-def _grantRotateRights(iam, projectId, service_account, email, account_type='serviceAccount'):
+def _grantRotateRights(iam, projectId, service_account, account_type='serviceAccount'):
   body = {'policy': {'bindings': [{'role': 'roles/iam.serviceAccountKeyAdmin',
-                                   'members': [f'{account_type}:{email}']}]}}
+                                   'members': [f'{account_type}:{service_account}']}]}}
   maxRetries = 10
-  printEntityMessage([Ent.PROJECT, projectId, Ent.SVCACCT, email],
-                     Msg.HAS_RIGHTS_TO_ROTATE_OWN_PRIVATE_KEY.format(email, service_account))
+  kvList = [Ent.PROJECT, projectId, Ent.SVCACCT, service_account]
+  printEntityMessage(kvList, Msg.GRANTING_RIGHTS_TO_ROTATE_ITS_OWN_PRIVATE_KEY.format('Granting'))
   for retry in range(1, maxRetries+1):
     try:
       callGAPI(iam.projects().serviceAccounts(), 'setIamPolicy',
                throwReasons=[GAPI.INVALID_ARGUMENT],
                resource=f'projects/{projectId}/serviceAccounts/{service_account}', body=body)
+      printEntityMessage(kvList, Msg.GRANTING_RIGHTS_TO_ROTATE_ITS_OWN_PRIVATE_KEY.format('Granted'))
       return True
     except GAPI.invalidArgument as e:
-      entityActionFailedWarning([Ent.PROJECT, projectId, Ent.SVCACCT, service_account], str(e))
+      entityActionFailedWarning(kvList, str(e))
       if 'does not exist' not in str(e) or retry == maxRetries:
         return False
       _waitForSvcAcctCompletion(retry)
     except Exception as e:
-      entityActionFailedWarning([Ent.PROJECT, projectId, Ent.SVCACCT, service_account], str(e))
+      entityActionFailedWarning(kvList, str(e))
       return False
 
 def _createOauth2serviceJSON(httpObj, projectInfo, svcAcctInfo, create_key=True):
@@ -11420,6 +11421,7 @@ def _createOauth2serviceJSON(httpObj, projectInfo, svcAcctInfo, create_key=True)
     return False
   except GAPI.alreadyExists as e:
     entityActionFailedWarning([Ent.PROJECT, projectInfo['projectId'], Ent.SVCACCT, svcAcctInfo['name']], str(e))
+    writeStderr(Msg.RERUN_THE_COMMAND_AND_SPECIFY_A_NEW_SANAME)
     return False
   GM.Globals[GM.SVCACCT_SCOPES_DEFINED] = False
   if create_key and not doProcessSvcAcctKeys(mode='retainexisting', iam=iam,
@@ -11428,7 +11430,7 @@ def _createOauth2serviceJSON(httpObj, projectInfo, svcAcctInfo, create_key=True)
                                              clientId=service_account['uniqueId']):
     return False
   sa_email = service_account['name'].rsplit('/', 1)[-1]
-  return _grantRotateRights(iam, projectInfo['projectId'], sa_email, sa_email)
+  return _grantRotateRights(iam, projectInfo['projectId'], sa_email)
 
 def _createClientSecretsOauth2service(httpObj, login_hint, appInfo, projectInfo, svcAcctInfo, create_key=True):
   def _checkClientAndSecret(csHttpObj, client_id, client_secret):
@@ -11921,9 +11923,7 @@ def doUpdateProject():
       continue
     iam = getAPIService(API.IAM, httpObj)
     _getSvcAcctData() # needed to read in GM.OAUTH2SERVICE_JSON_DATA
-    _grantRotateRights(iam, projectId,
-                       GM.Globals[GM.OAUTH2SERVICE_JSON_DATA]['client_email'],
-                       GM.Globals[GM.OAUTH2SERVICE_JSON_DATA]['client_email'])
+    _grantRotateRights(iam, projectId, GM.Globals[GM.OAUTH2SERVICE_JSON_DATA]['client_email'])
   Ind.Decrement()
 
 # gam delete project [[admin] <EmailAddress>] [<ProjectIDEntity>]
@@ -12786,7 +12786,7 @@ def doUploadSvcAcctKeys():
   iam = getAPIService(API.IAM, httpObj)
   if doProcessSvcAcctKeys(mode='upload', iam=iam):
     sa_email = GM.Globals[GM.OAUTH2SERVICE_JSON_DATA]['client_email']
-    _grantRotateRights(iam, GM.Globals[GM.OAUTH2SERVICE_JSON_DATA]['project_id'], sa_email, sa_email)
+    _grantRotateRights(iam, GM.Globals[GM.OAUTH2SERVICE_JSON_DATA]['project_id'], sa_email)
     sys.stdout.write(Msg.YOUR_GAM_PROJECT_IS_CREATED_AND_READY_TO_USE)
 
 # gam delete sakeys <ServiceAccountKeyList>

{gam7-7.6.5 → gam7-7.6.8}/src/gam/gamlib/glmsgs.py

@@ -72,7 +72,7 @@ Please go to:
 24. Paste it at the "Enter your Client Secret: " prompt in your terminal
 25. Press return/enter in your terminal
 26. Switch back to the browser
-27. Click "CANCEL"
+27. Click "OK"
 28. These steps are complete
 '''
 ENTER_YOUR_CLIENT_ID = '\nEnter your Client ID: '
@@ -287,6 +287,7 @@ GAM_OUT_OF_MEMORY = 'GAM has run out of memory. If this is a large Google Worksp
 GENERATING_NEW_PRIVATE_KEY = 'Generating new private key'
 GETTING = 'Getting'
 GETTING_ALL = 'Getting all'
+GRANTING_RIGHTS_TO_ROTATE_ITS_OWN_PRIVATE_KEY = '{0} rights to rotate its own private key'
 GOOGLE_DELEGATION_ERROR = 'Google delegation error, delegator and delegate both exist and are valid for delegation'
 GOT = 'Got'
 GROUP_MAPS_TO_MULTIPLE_OUS = 'File: {0}, Group: {1} references multiple OUs: {2}'
@@ -294,13 +295,12 @@ GROUP_MAPS_TO_OU_INVALID_ROW = 'File: {0}, Invalid row, must contain non-blank <
 GUARDIAN_INVITATION_STATUS_NOT_PENDING = 'Guardian invitation status is not PENDING'
 HAS_CHILD_ORGS = 'Has child {0}'
 HAS_INVALID_FORMAT = '{0}: {1}, Has invalid format'
-HAS_RIGHTS_TO_ROTATE_OWN_PRIVATE_KEY = 'Giving account {0} rights to rotate {1} private key'
 HEADER_NOT_FOUND_IN_CSV_HEADERS = 'Header "{0}" not found in CSV headers of "{1}".'
 HELP_SYNTAX = 'Help: Syntax in file {0}\n'
 HELP_WIKI = 'Help: Documentation is at {0}\n'
 IGNORED = 'Ignored'
 INSTRUCTIONS_CLIENT_SECRETS_JSON = 'Please run\n\ngam create|use project\ngam oauth create\n\nto create and authorize a Client account.\n'
-INSTRUCTIONS_OAUTH2SERVICE_JSON = 'Please run\n\ngam create|use project\ngam user <user> check serviceaccount\n\nto create and authorize a Service account.\n'
+INSTRUCTIONS_OAUTH2SERVICE_JSON = 'Please run\n\ngam create|use project\ngam user <user> update serviceaccount\n\nto create and authorize a Service account.\n'
 INSUFFICIENT_PERMISSIONS_TO_PERFORM_TASK = 'Insufficient permissions to perform this task'
 INTER_BATCH_WAIT_INCREASED = 'inter_batch_wait increased to {0:.2f}'
 INVALID = 'Invalid'
@@ -468,6 +468,10 @@ REFUSING_TO_DEPROVISION_DEVICES = 'Refusing to deprovision {0} devices because a
 REPLY_TO_CUSTOM_REQUIRES_EMAIL_ADDRESS = 'replyto REPLY_TO_CUSTOM requires customReplyTo <EmailAddress>'
 REQUEST_COMPLETED_NO_FILES = 'Request completed but no results/files were returned, try requesting again'
 REQUEST_NOT_COMPLETE = 'Request needs to be completed before downloading, current status is: {0}'
+RERUN_THE_COMMAND_AND_SPECIFY_A_NEW_SANAME = """
+Re-run the command specify a new service account name with: saname <ServiceAccountName>
+See: https://github.com/GAM-team/GAM/wiki/Authorization#advanced-use
+"""
 RESOURCE_CAPACITY_FLOOR_REQUIRED = 'Options "capacity <Number>" (<Number> > 0) and "floor <String>" required'
 RESOURCE_FLOOR_REQUIRED = 'Option "floor <String>" required'
 RESULTS_TOO_LARGE_FOR_GOOGLE_SPREADSHEET = 'Results are too large for Google Spreadsheets. Uploading as a regular CSV file.'

{gam7-7.6.5 → gam7-7.6.8}/src/gam-install.sh

@@ -8,7 +8,7 @@ GAM installation script.
 OPTIONS:
    -h      show help.
    -d      Directory where gam folder will be installed. Default is \$HOME/bin/
-   -a      Architecture to install (i386, x86_64, x86_64_legacy, arm, arm64). Default is to detect your arch with "uname -m".
+   -a      Architecture to install (x86_64, arm64). Default is to detect your arch with "uname -m".
    -o      OS we are running (linux, macos). Default is to detect your OS with "uname -s".
    -b      OS version. Default is to detect on MacOS and Linux.
    -l      Just upgrade GAM to latest version. Skips project creation and auth.
@@ -194,7 +194,7 @@ fi
 case $gamos in
   [lL]inux)
     gamos="linux"
-    download_urls=$(echo -e "$download_urls" | grep "\-linux-")
+    download_urls=$(echo -e "$download_urls" | grep -e "-linux-")
     if [ "$osversion" == "" ]; then
       this_glibc_ver=$(ldd --version | awk '/ldd/{print $NF}')
     else
@@ -203,7 +203,7 @@ case $gamos in
     echo "This Linux distribution uses glibc $this_glibc_ver"
     case $gamarch in
       x86_64)
-	download_urls=$(echo -e "$download_urls" | grep "\-x86_64-")
+	download_urls=$(echo -e "$download_urls" | grep -e "-x86_64-")
 	gam_x86_64_glibc_vers=$(echo -e "$download_urls" | \
 		grep --only-matching 'glibc[0-9\.]*\.tar\.xz$' \
 	        | cut -c 6-9 )
@@ -218,7 +218,7 @@ case $gamos in
         download_url=$(echo -e "$download_urls" | grep "$useglibc")
 	;;
       arm|arm64|aarch64)
-        download_urls=$(echo -e "$download_urls" | grep "\-aarch64-")
+        download_urls=$(echo -e "$download_urls" | grep -e "-arm64-\|-aarch64-")
         gam_arm64_glibc_vers=$(echo -e "$download_urls" | \
                 grep --only-matching 'glibc[0-9\.]*\.tar\.xz$' | \
                 cut -c 6-9)
@@ -243,13 +243,13 @@ case $gamos in
     # override osversion only if it wasn't set by cli arguments
     osversion=${osversion:-${currentversion}}
     # override osversion only if it wasn't set by cli arguments
-    download_urls=$(echo -e "$download_urls" | grep "\-macos")
+    download_urls=$(echo -e "$download_urls" | grep -e "-macos")
     case $gamarch in
       x86_64)
-        archgrep="\-x86_64"
+        archgrep="-x86_64"
 	;;
       arm|arm64|aarch64)
-        archgrep="\-aarch64"
+        archgrep="-arm64\|-aarch64"
         ;;
       *)
         echo_red "ERROR: this installer currently only supports x86_64 and arm64 MacOS. Looks like you're running on ${gamarch}. Exiting."
@@ -257,13 +257,13 @@ case $gamos in
 	;;
     esac
     gam_macos_urls=$(echo -e "$download_urls" | \
-                     grep "$archgrep")
+                     grep -e $archgrep)
     versionless_urls=$(echo -e "$gam_macos_urls" | \
-                       grep "\-macos-")
+                       grep -e "-macos-")
     if [ "$versionless_urls" == "" ]; then
         # versions after 7.00.38 include MacOS version info
         gam_macos_vers=$(echo -e "$gam_macos_urls" | \
-                         grep --only-matching '\-macos[0-9\.]*' | \
+                         grep --only-matching -e '-macos[0-9\.]*' | \
                          cut -c 7-10)
         for gam_mac_ver in $gam_macos_vers; do
             if version_gt $currentversion $gam_mac_ver; then
@@ -281,13 +281,12 @@ case $gamos in
         case $gamarch in
             x86_64)
 	        minimum_version=13
-                download_url=$(echo -e "$download_urls" | grep "\-x86_64")
                 ;;
             arm|arm64|aarch64)
-                download_url=$(echo -e "$download_urls" | grep "\-aarch64")
 	        minimum_version=14
                 ;;
         esac
+        download_url=$(echo -e "$download_urls" | grep -e $archgrep)
         if version_gt "$osversion" "$minimum_version"; then
             echo_green "You are running MacOS ${osversion}, good. Downloading GAM from ${download_url}."
         else
@@ -304,7 +303,7 @@ case $gamos in
     gamos="windows"
     echo "You are running Windows"
     download_url=$(echo -e "$download_urls" | \
-                   grep "\-windows-" | \
+                   grep -e "-windows-" | \
                    grep ".zip")
     ;;
   *)

{gam7-7.6.5 → gam7-7.6.8}/src/requirements.txt

@@ -10,5 +10,6 @@ httplib2>=0.22.0
 lxml
 passlib>=1.7.4
 pathvalidate
+pyscard==2.2.1
 python-dateutil
 yubikey-manager[yubikey]>=5.6.1

{gam7-7.6.5 → gam7-7.6.8}/src/setup.cfg

@@ -35,6 +35,7 @@ install_requires =
     lxml
     passlib >= 1.7.4
     pathvalidate
+    pyscard==2.2.1
     python-dateutil
     yubikey-manager >= 5.0
 

{gam7-7.6.5 → gam7-7.6.8}/wiki/Authorization.md

@@ -283,7 +283,7 @@ You can skip these steps if you know that untrusted third-party apps are allowed
 * `<ServiceAccountDisplayName>` - `<ProjectName>`
 * `<ServiceAccountDescription>` - `<ServiceAccountDisplayName>`
 
-### Basic
+### Basic Create
 Create a project with default values for the project and service account.
 ```
 gam create project [<EmailAddress>] [<ProjectID>]
@@ -291,7 +291,7 @@ gam create project [<EmailAddress>] [<ProjectID>]
 * `<EmailAddress>` - Google Workspace admin/GCP project manager; if omitted, you will be prompted for the address
 * `<ProjectID>` - A new Google project ID; if omitted, a default value will be used
 
-### Advanced
+### Advanced Create
 Create a project with user-specified values for the project and service account.
 ```
 gam create project [admin <EmailAddress>] [project <ProjectID>]
@@ -326,7 +326,7 @@ Use an existing project to create and download two files: `client_secrets.json`
 * `<ServiceAccountDisplayName>` - `<ProjectName>`
 * `<ServiceAccountDescription>` - `<ServiceAccountDisplayName>`
 
-### Basic
+### Basic Use
 Use an existing uninitialized/uncredentialed project and configure it to be a GAM project; this typically used when
 the GCP  administrators have created a basic project because project creation is not available for most users.
 
@@ -338,12 +338,13 @@ gam use project [<EmailAddress>] [project <ProjectID>]
 * `<EmailAddress>` - Google Workspace admin/GCP project manager; if omitted, you will be prompted for the address
 * `<ProjectID>` - An existing Google project ID; if omitted, you will be prompted for the ID
 
-### Advanced
+### Advanced Use
 Use an existing project with user-specified values for the service account. If the project is already
 a GAM project you must use `saname <ServiceAccountName>` as the existing service account information
 can not be re-downloaded.
 ```
 gam use project [admin <EmailAddress>] [project <ProjectID>]
+        [appname <String>] [supportemail <EmailAddress>]
         [saname <ServiceAccountName>] [sadisplayname <ServiceAccountDisplayName>]
         [sadescription <ServiceAccountDescription>]
         [(algorithm KEY_ALG_RSA_1024|KEY_ALG_RSA_2048)|