google-auth 2.55.0__tar.gz → 2.55.2__tar.gz

{google_auth-2.55.0/google_auth.egg-info → google_auth-2.55.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-auth
-Version: 2.55.0
+Version: 2.55.2
 Summary: Google Authentication Library
 Home-page: https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
 Author: Google Cloud Platform
@@ -27,13 +27,13 @@ Requires-Dist: pyasn1-modules>=0.2.1
 Requires-Dist: cryptography>=38.0.3
 Provides-Extra: cryptography
 Requires-Dist: cryptography>=38.0.3; extra == "cryptography"
+Provides-Extra: pyopenssl
+Requires-Dist: cryptography>=38.0.3; extra == "pyopenssl"
 Provides-Extra: aiohttp
 Requires-Dist: aiohttp<4.0.0,>=3.8.0; extra == "aiohttp"
 Requires-Dist: requests<3.0.0,>=2.20.0; extra == "aiohttp"
 Provides-Extra: enterprise-cert
-Requires-Dist: pyopenssl; extra == "enterprise-cert"
-Provides-Extra: pyopenssl
-Requires-Dist: pyopenssl>=20.0.0; extra == "pyopenssl"
+Requires-Dist: cryptography>=38.0.3; extra == "enterprise-cert"
 Provides-Extra: pyjwt
 Requires-Dist: pyjwt>=2.0; extra == "pyjwt"
 Provides-Extra: reauth
@@ -41,14 +41,14 @@ Requires-Dist: pyu2f>=0.1.5; extra == "reauth"
 Provides-Extra: requests
 Requires-Dist: requests<3.0.0,>=2.20.0; extra == "requests"
 Provides-Extra: testing
-Requires-Dist: grpcio; extra == "testing"
+Requires-Dist: grpcio<2.0.0,>=1.59.0; python_version < "3.14" and extra == "testing"
+Requires-Dist: grpcio<2.0.0,>=1.75.1; python_version >= "3.14" and extra == "testing"
 Requires-Dist: flask; extra == "testing"
 Requires-Dist: freezegun; extra == "testing"
 Requires-Dist: pyjwt>=2.0; extra == "testing"
 Requires-Dist: pytest; extra == "testing"
 Requires-Dist: pytest-cov; extra == "testing"
 Requires-Dist: pytest-localserver; extra == "testing"
-Requires-Dist: pyopenssl>=20.0.0; extra == "testing"
 Requires-Dist: pyu2f>=0.1.5; extra == "testing"
 Requires-Dist: responses; extra == "testing"
 Requires-Dist: urllib3; extra == "testing"
@@ -57,13 +57,14 @@ Requires-Dist: aiohttp<4.0.0,>=3.8.0; extra == "testing"
 Requires-Dist: requests<3.0.0,>=2.20.0; extra == "testing"
 Requires-Dist: aioresponses; extra == "testing"
 Requires-Dist: pytest-asyncio; extra == "testing"
-Requires-Dist: pyopenssl<24.3.0; extra == "testing"
-Requires-Dist: aiohttp<3.10.0; extra == "testing"
 Provides-Extra: urllib3
 Requires-Dist: urllib3; extra == "urllib3"
 Requires-Dist: packaging; extra == "urllib3"
 Provides-Extra: rsa
 Requires-Dist: rsa<5,>=3.1.4; extra == "rsa"
+Provides-Extra: grpc
+Requires-Dist: grpcio<2.0.0,>=1.59.0; python_version < "3.14" and extra == "grpc"
+Requires-Dist: grpcio<2.0.0,>=1.75.1; python_version >= "3.14" and extra == "grpc"
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/_agent_identity_utils.py

@@ -16,16 +16,15 @@
 
 import base64
 import hashlib
-import logging
 import os
 import re
+import stat
 import time
 from urllib.parse import quote, urlparse
+import warnings
 
 from google.auth import environment_vars, exceptions
 
-_LOGGER = logging.getLogger(__name__)
-
 CRYPTOGRAPHY_NOT_FOUND_ERROR = (
     "The cryptography library is required for certificate-based authentication."
     "Please install it with `pip install google-auth[cryptography]`."
@@ -58,8 +57,20 @@ _POLLING_INTERVALS = ([_FAST_POLL_INTERVAL] * _FAST_POLL_CYCLES) + (
 
 
 def _is_certificate_file_ready(path):
-    """Checks if a file exists and is not empty."""
-    return path and os.path.exists(path) and os.path.getsize(path) > 0
+    """Checks if a file exists, is a regular file, and is not empty."""
+    if not path:
+        return False
+    try:
+        # Check if the path points to a regular file and is not empty.
+        # stat.S_ISREG is used instead of os.path.isfile to avoid swallowing
+        # PermissionError exceptions, which the caller needs to propagate.
+        st = os.stat(path)
+        return stat.S_ISREG(st.st_mode) and st.st_size > 0
+    except PermissionError:
+        # Propagate PermissionError to let caller handle it (fail-fast or fallback)
+        raise
+    except OSError:
+        return False
 
 
 def get_agent_identity_certificate_path():
@@ -141,13 +152,17 @@ def get_agent_identity_certificate_path():
 
             # Log a warning on the first failed attempt to load the certificate file
             if not has_logged_cert_warning:
-                _LOGGER.warning(
-                    "Certificate file not ready at %s. Retrying until startup timeout (up to %s seconds total)...",
-                    target_path,
-                    _TOTAL_TIMEOUT,
+                warnings.warn(
+                    f"Certificate file not ready at {target_path}. Retrying until startup timeout (up to {_TOTAL_TIMEOUT} seconds total)..."
                 )
                 has_logged_cert_warning = True
 
+        except PermissionError as e:
+            warnings.warn(
+                f"Permission denied when accessing certificate config or certificate file: {e}. "
+                "Token binding protection cannot be enabled. Falling back to unbound tokens."
+            )
+            return None
         except (IOError, ValueError, KeyError) as e:
             if cert_config_path and os.path.exists(cert_config_path):
                 # If the file exists but has invalid JSON or is unreadable,
@@ -155,12 +170,10 @@ def get_agent_identity_certificate_path():
                 return None
 
             if not has_logged_config_warning and cert_config_path:
-                _LOGGER.warning(
-                    "Certificate config file not found or incomplete: %s (from %s "
-                    "environment variable). Retrying until startup timeout (up to %s seconds total)...",
-                    e,
-                    environment_vars.GOOGLE_API_CERTIFICATE_CONFIG,
-                    _TOTAL_TIMEOUT,
+                warnings.warn(
+                    f"Certificate config file not found or incomplete: {e} (from "
+                    f"{environment_vars.GOOGLE_API_CERTIFICATE_CONFIG} environment variable). "
+                    f"Retrying until startup timeout (up to {_TOTAL_TIMEOUT} seconds total)..."
                 )
                 has_logged_config_warning = True
             pass
@@ -201,12 +214,26 @@ def get_and_parse_agent_identity_certificate():
     if is_opted_out:
         return None
 
+    # Respect explicit opt-out of mTLS / client certs
+    from google.auth.transport import _mtls_helper
+
+    env_override = _mtls_helper._check_use_client_cert_env()
+    if env_override is False:
+        return None
+
     cert_path = get_agent_identity_certificate_path()
     if not cert_path:
         return None
 
-    with open(cert_path, "rb") as cert_file:
-        cert_bytes = cert_file.read()
+    try:
+        with open(cert_path, "rb") as cert_file:
+            cert_bytes = cert_file.read()
+    except PermissionError as e:
+        warnings.warn(
+            f"Failed to read agent identity certificate file at {cert_path}: {e}. "
+            "Token binding protection cannot be enabled. Falling back to unbound tokens."
+        )
+        return None
 
     return parse_certificate(cert_bytes)
 
@@ -312,7 +339,17 @@ def should_request_bound_token(cert):
         ).lower()
         == "true"
     )
-    return is_agent_cert and is_opted_in
+    if not (is_agent_cert and is_opted_in):
+        return False
+
+    # Respect explicit opt-out of mTLS / client certs
+    from google.auth.transport import _mtls_helper
+
+    env_override = _mtls_helper._check_use_client_cert_env()
+    if env_override is False:
+        return False
+
+    return True
 
 
 def get_cached_cert_fingerprint(cached_cert):

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/_regional_access_boundary_utils.py

@@ -219,10 +219,9 @@ class _RegionalAccessBoundaryManager(object):
         """
         # Async credentials do not support blocking lookups.
         if inspect.iscoroutinefunction(credentials._lookup_regional_access_boundary):
-            if _helpers.is_logging_enabled(_LOGGER):
-                _LOGGER.warning(
-                    "Blocking Regional Access Boundary lookup is not supported for async credentials."
-                )
+            _LOGGER.debug(
+                "Blocking Regional Access Boundary lookup is not supported for async credentials."
+            )
             self.process_regional_access_boundary_info(None)
             return
 
@@ -234,12 +233,11 @@ class _RegionalAccessBoundaryManager(object):
                 credentials._lookup_regional_access_boundary(request, fail_fast=True)
             )
         except Exception as e:
-            if _helpers.is_logging_enabled(_LOGGER):
-                _LOGGER.warning(
-                    "Blocking Regional Access Boundary lookup raised an exception: %s",
-                    e,
-                    exc_info=True,
-                )
+            _LOGGER.debug(
+                "Blocking Regional Access Boundary lookup raised an exception: %s",
+                e,
+                exc_info=True,
+            )
             regional_access_boundary_info = None
 
         self.process_regional_access_boundary_info(regional_access_boundary_info)
@@ -265,12 +263,11 @@ class _RegionalAccessBoundaryManager(object):
                 )
             )
         except Exception as e:
-            if _helpers.is_logging_enabled(_LOGGER):
-                _LOGGER.warning(
-                    "Regional Access Boundary lookup raised an exception: %s",
-                    e,
-                    exc_info=True,
-                )
+            _LOGGER.debug(
+                "Regional Access Boundary lookup raised an exception: %s",
+                e,
+                exc_info=True,
+            )
             regional_access_boundary_info = None
 
         self.process_regional_access_boundary_info(regional_access_boundary_info)
@@ -297,14 +294,12 @@ class _RegionalAccessBoundaryManager(object):
                     cooldown_expiry=None,
                     cooldown_duration=DEFAULT_REGIONAL_ACCESS_BOUNDARY_COOLDOWN,
                 )
-                if _helpers.is_logging_enabled(_LOGGER):
-                    _LOGGER.debug("Regional Access Boundary lookup successful.")
+                _LOGGER.debug("Regional Access Boundary lookup successful.")
             else:
                 # On failure, calculate cooldown and update state.
-                if _helpers.is_logging_enabled(_LOGGER):
-                    _LOGGER.warning(
-                        "Regional Access Boundary lookup failed. Entering cooldown."
-                    )
+                _LOGGER.debug(
+                    "Regional Access Boundary lookup failed. Entering cooldown."
+                )
 
                 next_cooldown_expiry = (
                     _helpers.utcnow() + current_data.cooldown_duration
@@ -367,12 +362,11 @@ class _RegionalAccessBoundaryRefreshThread(threading.Thread):
                 self._credentials._lookup_regional_access_boundary(self._request)
             )
         except Exception as e:
-            if _helpers.is_logging_enabled(_LOGGER):
-                _LOGGER.warning(
-                    "Asynchronous Regional Access Boundary lookup raised an exception: %s",
-                    e,
-                    exc_info=True,
-                )
+            _LOGGER.debug(
+                "Asynchronous Regional Access Boundary lookup raised an exception: %s",
+                e,
+                exc_info=True,
+            )
             regional_access_boundary_info = None
 
         self._rab_manager.process_regional_access_boundary_info(
@@ -419,13 +413,12 @@ class _RegionalAccessBoundaryRefreshManager(object):
             try:
                 copied_request = copy.deepcopy(request)
             except Exception as e:
-                if _helpers.is_logging_enabled(_LOGGER):
-                    _LOGGER.warning(
-                        "Could not deepcopy transport for background RAB refresh. "
-                        "Skipping background refresh to avoid thread safety issues. "
-                        "Exception: %s",
-                        e,
-                    )
+                _LOGGER.debug(
+                    "Could not deepcopy transport for background RAB refresh. "
+                    "Skipping background refresh to avoid thread safety issues. "
+                    "Exception: %s",
+                    e,
+                )
                 return
 
             self._worker = _RegionalAccessBoundaryRefreshThread(
@@ -479,14 +472,13 @@ async def _close_cloned_request(lookup_request, is_cloned):
         if is_async := inspect.isawaitable(maybe_coro):
             await maybe_coro
     except Exception as e:
-        if _helpers.is_logging_enabled(_LOGGER):
-            adapter_type = " asynchronous " if is_async else " "
-            _LOGGER.warning(
-                "Failed to cleanly close cloned%srequest transport: %s",
-                adapter_type,
-                e,
-                exc_info=True,
-            )
+        adapter_type = " asynchronous " if is_async else " "
+        _LOGGER.debug(
+            "Failed to cleanly close cloned%srequest transport: %s",
+            adapter_type,
+            e,
+            exc_info=True,
+        )
 
 
 class _AsyncRegionalAccessBoundaryRefreshManager(object):
@@ -532,12 +524,11 @@ class _AsyncRegionalAccessBoundaryRefreshManager(object):
                     is_cloned,
                 ) = _prepare_async_lookup_callable(request)
             except Exception as e:
-                if _helpers.is_logging_enabled(_LOGGER):
-                    _LOGGER.warning(
-                        "Synchronous cloning of request for Regional Access Boundary lookup failed: %s",
-                        e,
-                        exc_info=True,
-                    )
+                _LOGGER.debug(
+                    "Synchronous cloning of request for Regional Access Boundary lookup failed: %s",
+                    e,
+                    exc_info=True,
+                )
                 rab_manager.process_regional_access_boundary_info(None)
                 return
 
@@ -549,12 +540,11 @@ class _AsyncRegionalAccessBoundaryRefreshManager(object):
                         )
                     )
                 except Exception as e:
-                    if _helpers.is_logging_enabled(_LOGGER):
-                        _LOGGER.warning(
-                            "Asynchronous Regional Access Boundary lookup raised an exception: %s",
-                            e,
-                            exc_info=True,
-                        )
+                    _LOGGER.debug(
+                        "Asynchronous Regional Access Boundary lookup raised an exception: %s",
+                        e,
+                        exc_info=True,
+                    )
                     regional_access_boundary_info = None
                 finally:
                     await _close_cloned_request(lookup_request, is_cloned)

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/aio/_helpers.py

@@ -14,7 +14,6 @@
 
 """Helper functions for commonly used utilities."""
 
-
 import logging
 from typing import Any
 
@@ -60,3 +59,13 @@ async def response_log_async(logger: logging.Logger, response: Any) -> None:
         # json_response = await _parse_response_async(response)
         json_response = None
         _helpers._response_log_base(logger, json_response)
+
+
+def _get_local_addr(connector: Any) -> Any:
+    local_addr = getattr(connector, "_local_addr", None)
+    if local_addr is not None:
+        return local_addr
+    local_addr_infos = getattr(connector, "_local_addr_infos", None)
+    if local_addr_infos:
+        return local_addr_infos[0][4]
+    return None

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/aio/transport/aiohttp.py

@@ -248,7 +248,7 @@ class Request(transport.Request):
                     limit=getattr(orig_connector, "_limit", 100),
                     limit_per_host=getattr(orig_connector, "_limit_per_host", 0),
                     force_close=getattr(orig_connector, "_force_close", False),
-                    local_addr=getattr(orig_connector, "_local_addr", None),
+                    local_addr=_helpers_async._get_local_addr(orig_connector),
                 )
             elif getattr(aiohttp, "UnixConnector", None) and isinstance(
                 orig_connector, getattr(aiohttp, "UnixConnector")

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/aio/transport/mtls.py

@@ -17,42 +17,18 @@ Helper functions for mTLS in async for discovery of certs.
 """
 
 import asyncio
-import contextlib
+import inspect
 import logging
-import os
 import ssl
-import tempfile
 from typing import Optional
 
 from google.auth import exceptions
-import google.auth.transport._mtls_helper
+from google.auth.transport._mtls_helper import secure_cert_key_paths
 import google.auth.transport.mtls
 
 _LOGGER = logging.getLogger(__name__)
 
 
-@contextlib.contextmanager
-def _create_temp_file(content: bytes):
-    """Creates a temporary file with the given content.
-
-    Args:
-        content (bytes): The content to write to the file.
-
-    Yields:
-        str: The path to the temporary file.
-    """
-    # Create a temporary file that is readable only by the owner.
-    fd, file_path = tempfile.mkstemp()
-    try:
-        with os.fdopen(fd, "wb") as f:
-            f.write(content)
-        yield file_path
-    finally:
-        # Securely delete the file after use.
-        if os.path.exists(file_path):
-            os.remove(file_path)
-
-
 def make_client_cert_ssl_context(
     cert_bytes: bytes, key_bytes: bytes, passphrase: Optional[bytes] = None
 ) -> ssl.SSLContext:
@@ -71,19 +47,29 @@ def make_client_cert_ssl_context(
     Raises:
         google.auth.exceptions.TransportError: If there is an error loading the certificate.
     """
-    with _create_temp_file(cert_bytes) as cert_path, _create_temp_file(
-        key_bytes
-    ) as key_path:
-        try:
+    try:
+        with secure_cert_key_paths(cert_bytes, key_bytes, passphrase=passphrase) as (
+            cert_path,
+            key_path,
+            passphrase_val,
+        ):
             context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
-            context.load_cert_chain(
-                certfile=cert_path, keyfile=key_path, password=passphrase
-            )
+            if cert_path:
+                password = (
+                    passphrase_val.decode("utf-8")
+                    if isinstance(passphrase_val, bytes)
+                    else passphrase_val
+                )
+                context.load_cert_chain(
+                    certfile=cert_path,
+                    keyfile=key_path,
+                    password=password,
+                )
             return context
-        except (ssl.SSLError, OSError, IOError, ValueError, RuntimeError) as exc:
-            raise exceptions.TransportError(
-                "Failed to load client certificate and key for mTLS."
-            ) from exc
+    except (ssl.SSLError, OSError, IOError, ValueError, RuntimeError, TypeError) as exc:
+        raise exceptions.TransportError(
+            "Failed to load client certificate and key for mTLS."
+        ) from exc
 
 
 async def _run_in_executor(func, *args):
@@ -187,9 +173,9 @@ async def get_client_cert_and_key(client_cert_callback=None):
     """
     if client_cert_callback:
         result = client_cert_callback()
-        try:
+        if inspect.isawaitable(result):
             cert, key = await result
-        except TypeError:
+        else:
             cert, key = result
         return True, cert, key
 

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/aio/transport/sessions.py

@@ -17,6 +17,7 @@ from contextlib import asynccontextmanager
 import functools
 import time
 from typing import Mapping, Optional, TYPE_CHECKING, Union
+import warnings
 
 from google.auth import _exponential_backoff, exceptions
 from google.auth.aio import transport
@@ -36,6 +37,7 @@ else:
     except (ImportError, AttributeError):
         ClientTimeout = None
 
+
 # Tracks the internal aiohttp installation and usage
 try:
     from google.auth.aio.transport.aiohttp import Request as AiohttpRequest
@@ -150,11 +152,11 @@ class AsyncAuthorizedSession:
     async def configure_mtls_channel(self, client_cert_callback=None):
         """Configure the client certificate and key for SSL connection.
 
-        The function does nothing unless `GOOGLE_API_USE_CLIENT_CERTIFICATE` is
-        explicitly set to `true`. In this case if client certificate and key are
-        successfully obtained (from the given client_cert_callback or from application
-        default SSL credentials), the underlying transport will be reconfigured
-        to use mTLS.
+        This method configures mTLS if client certificates are explicitly enabled
+        (via GOOGLE_API_USE_CLIENT_CERTIFICATE=true) or auto-enabled (when the env
+        variable is unset and workload certificates are discovered). In these cases,
+        the underlying transport will be reconfigured to use mTLS.
+
         Note: This function does nothing if the `aiohttp` library is not
         installed.
         Important: Calling this method will close any ongoing API requests associated
@@ -180,18 +182,16 @@ class AsyncAuthorizedSession:
                     google.auth.transport._mtls_helper.check_use_client_cert
                 )
                 if not use_client_cert:
-                    self._is_mtls = False
                     return
 
                 try:
                     (
-                        self._is_mtls,
+                        is_mtls,
                         cert,
                         key,
                     ) = await mtls.get_client_cert_and_key(client_cert_callback)
 
-                    if self._is_mtls:
-                        self._cached_cert = cert
+                    if is_mtls:
                         ssl_context = await mtls._run_in_executor(
                             mtls.make_client_cert_ssl_context, cert, key
                         )
@@ -206,13 +206,29 @@ class AsyncAuthorizedSession:
                             old_auth_request = self._auth_request
                             self._auth_request = AiohttpRequest(session=new_session)
 
-                            await old_auth_request.close()
+                            try:
+                                await old_auth_request.close()
+                            except Exception:
+                                # Suppress so it doesn't abort the mTLS configuration
+                                pass
+                        else:
+                            is_mtls = False
+                            warnings.warn(
+                                "Attempted to establish mTLS, but a custom async transport was provided. "
+                                "google-auth cannot automatically configure custom transports for mTLS. "
+                                "Falling back to standard TLS. If your custom transport is not manually "
+                                "configured for mTLS, you may encounter 401 Unauthorized errors when "
+                                "using Certificate-Bound Tokens.",
+                                UserWarning,
+                            )
+
+                    self._is_mtls = is_mtls
+                    if is_mtls:
+                        self._cached_cert = cert
+                    else:
+                        self._cached_cert = None
 
-                except (
-                    exceptions.ClientCertError,
-                    ImportError,
-                    OSError,
-                ) as caught_exc:
+                except Exception as caught_exc:
                     new_exc = exceptions.MutualTLSChannelError(caught_exc)
                     raise new_exc from caught_exc
 
@@ -573,4 +589,10 @@ class AsyncAuthorizedSession:
         """
         Close the underlying auth request session.
         """
+        if self._mtls_init_task and not self._mtls_init_task.done():
+            self._mtls_init_task.cancel()
+            try:
+                await self._mtls_init_task
+            except asyncio.CancelledError:
+                pass
         await self._auth_request.close()

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/compute_engine/_mtls.py

@@ -120,8 +120,9 @@ class MdsMtlsAdapter(HTTPAdapter):
         self.ssl_context = ssl.create_default_context()
         self.ssl_context.load_verify_locations(cafile=mds_mtls_config.ca_cert_path)
         self.ssl_context.load_cert_chain(
-            certfile=mds_mtls_config.client_combined_cert_path
+            certfile=mds_mtls_config.client_combined_cert_path, password=""
         )
+        self._fallback_adapter = HTTPAdapter()
         super(MdsMtlsAdapter, self).__init__(*args, **kwargs)
 
     def init_poolmanager(self, *args, **kwargs):
@@ -146,6 +147,8 @@ class MdsMtlsAdapter(HTTPAdapter):
             ssl.SSLError,
             requests.exceptions.SSLError,
             requests.exceptions.HTTPError,
+            requests.exceptions.ConnectionError,
+            requests.exceptions.Timeout,
         ) as e:
             _LOGGER.warning(
                 "mTLS connection to Compute Engine Metadata server failed. "
@@ -157,6 +160,9 @@ class MdsMtlsAdapter(HTTPAdapter):
             http_fallback_url = urlunparse(parsed_original_url._replace(scheme="http"))
             request.url = http_fallback_url
 
-            # Use a standard HTTPAdapter for the fallback
-            http_adapter = HTTPAdapter()
-            return http_adapter.send(request, **kwargs)
+            # Use the cached standard HTTPAdapter for the fallback
+            return self._fallback_adapter.send(request, **kwargs)
+
+    def close(self):
+        self._fallback_adapter.close()
+        super(MdsMtlsAdapter, self).close()

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/compute_engine/credentials.py

@@ -219,7 +219,7 @@ class Credentials(
                 return None
 
         if not _metadata._is_service_account_email(self.service_account_email):
-            _LOGGER.info(
+            _LOGGER.debug(
                 "Service account email '%s' is not a valid email. Skipping Regional Access Boundary lookup.",
                 self.service_account_email,
             )

{google_auth-2.55.0 → google_auth-2.55.2}/google/auth/credentials.py

@@ -535,7 +535,7 @@ class CredentialsWithRegionalAccessBoundary(Credentials):
 
         url = self._build_regional_access_boundary_lookup_url(request=request)
         if not url:
-            _LOGGER.warning("Failed to build Regional Access Boundary lookup URL.")
+            _LOGGER.debug("Failed to build Regional Access Boundary lookup URL.")
             return None
 
         headers: Dict[str, str] = {}