@@ -116,7 +116,7 @@ github.com/bsphere/le_go                            7a984a84b5492ae539b79b62fb4a

 # gcplogs deps

 golang.org/x/oauth2                                 bf48bf16ab8d622ce64ec6ce98d2c98f916b6303

-google.golang.org/api                               de943baf05a022a8f921b544b7827bacaba1aed5

+google.golang.org/api                               dec2ee309f5b09fc59bc40676447c15736284d78 # v0.8.0

 github.com/golang/groupcache                        869f871628b6baa9cfbc11732cdf6546b17c1298

 go.opencensus.io                                    d835ff86be02193d324330acdb7d65546b05f814 # v0.22.3

 cloud.google.com/go                                 ceeb313ad77b789a7fa5287b36a1d127b69b7093 # v0.44.3

deleted file mode 100644

@@ -1,94 +0,0 @@

-// Copyright 2018, OpenCensus Authors

-//

-// Licensed under the Apache License, Version 2.0 (the "License");

-// you may not use this file except in compliance with the License.

-// You may obtain a copy of the License at

-//

-//     http://www.apache.org/licenses/LICENSE-2.0

-//

-// Unless required by applicable law or agreed to in writing, software

-// distributed under the License is distributed on an "AS IS" BASIS,

-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

-// See the License for the specific language governing permissions and

-// limitations under the License.

-

-// Package propagation implement X-Cloud-Trace-Context header propagation used

-// by Google Cloud products.

-package propagation // import "go.opencensus.io/exporter/stackdriver/propagation"

-

-import (

-	"encoding/binary"

-	"encoding/hex"

-	"fmt"

-	"net/http"

-	"strconv"

-	"strings"

-

-	"go.opencensus.io/trace"

-	"go.opencensus.io/trace/propagation"

-)

-

-const (

-	httpHeaderMaxSize = 200

-	httpHeader        = `X-Cloud-Trace-Context`

-)

-

-var _ propagation.HTTPFormat = (*HTTPFormat)(nil)

-

-// HTTPFormat implements propagation.HTTPFormat to propagate

-// traces in HTTP headers for Google Cloud Platform and Stackdriver Trace.

-type HTTPFormat struct{}

-

-// SpanContextFromRequest extracts a Stackdriver Trace span context from incoming requests.

-func (f *HTTPFormat) SpanContextFromRequest(req *http.Request) (sc trace.SpanContext, ok bool) {

-	h := req.Header.Get(httpHeader)

-	// See https://cloud.google.com/trace/docs/faq for the header HTTPFormat.

-	// Return if the header is empty or missing, or if the header is unreasonably

-	// large, to avoid making unnecessary copies of a large string.

-	if h == "" || len(h) > httpHeaderMaxSize {

-		return trace.SpanContext{}, false

-	}

-

-	// Parse the trace id field.

-	slash := strings.Index(h, `/`)

-	if slash == -1 {

-		return trace.SpanContext{}, false

-	}

-	tid, h := h[:slash], h[slash+1:]

-

-	buf, err := hex.DecodeString(tid)

-	if err != nil {

-		return trace.SpanContext{}, false

-	}

-	copy(sc.TraceID[:], buf)

-

-	// Parse the span id field.

-	spanstr := h

-	semicolon := strings.Index(h, `;`)

-	if semicolon != -1 {

-		spanstr, h = h[:semicolon], h[semicolon+1:]

-	}

-	sid, err := strconv.ParseUint(spanstr, 10, 64)

-	if err != nil {

-		return trace.SpanContext{}, false

-	}

-	binary.BigEndian.PutUint64(sc.SpanID[:], sid)

-

-	// Parse the options field, options field is optional.

-	if !strings.HasPrefix(h, "o=") {

-		return sc, true

-	}

-	o, err := strconv.ParseUint(h[2:], 10, 64)

-	if err != nil {

-		return trace.SpanContext{}, false

-	}

-	sc.TraceOptions = trace.TraceOptions(o)

-	return sc, true

-}

-

-// SpanContextToRequest modifies the given request to include a Stackdriver Trace header.

-func (f *HTTPFormat) SpanContextToRequest(sc trace.SpanContext, req *http.Request) {

-	sid := binary.BigEndian.Uint64(sc.SpanID[:])

-	header := fmt.Sprintf("%s/%d;o=%d", hex.EncodeToString(sc.TraceID[:]), sid, int64(sc.TraceOptions))

-	req.Header.Set(httpHeader, header)

-}

@@ -29,9 +29,9 @@ func main() {

 * For a longer tutorial, see the [Getting Started guide](https://github.com/google/google-api-go-client/blob/master/GettingStarted.md).

 * For examples, see the [examples directory](https://github.com/google/google-api-go-client/tree/master/examples).

 * For support, use the [golang-nuts](https://groups.google.com/group/golang-nuts) mailing list.

+* The code review instance may be found [here](https://code-review.googlesource.com).

 ## Status

-[![Build Status](https://travis-ci.org/google/google-api-go-client.png)](https://travis-ci.org/google/google-api-go-client)

 [![GoDoc](https://godoc.org/google.golang.org/api?status.svg)](https://godoc.org/google.golang.org/api)

 These are auto-generated Go libraries from the Google Discovery Service's JSON description files of the available "new style" Google APIs.

@@ -43,7 +43,7 @@ These client libraries are officially supported by Google.  However, the librari

 If you're working with Google Cloud Platform APIs such as Datastore or Pub/Sub,

 consider using the

-[Cloud Client Libraries for Go](https://github.com/GoogleCloudPlatform/google-cloud-go)

+[Cloud Client Libraries for Go](https://github.com/googleapis/google-cloud-go)

 instead. These are the new and

 idiomatic Go libraries targeted specifically at Google Cloud Platform Services.

@@ -71,7 +71,7 @@ Some credentials types require you to specify scopes, and service entry points m

 ```go

 import (

-        "golang.org/x/net/context"

+        "context"

         "golang.org/x/oauth2/google"

         "google.golang.org/api/compute/v1"

 )

new file mode 100644

@@ -0,0 +1,23 @@

+module google.golang.org/api

+

+go 1.9

+

+require (

+	cloud.google.com/go v0.38.0 // indirect

+	github.com/golang/protobuf v1.3.1 // indirect

+	github.com/google/go-cmp v0.3.0

+	github.com/googleapis/gax-go/v2 v2.0.5

+	github.com/hashicorp/golang-lru v0.5.1 // indirect

+	go.opencensus.io v0.21.0

+	golang.org/x/lint v0.0.0-20190409202823-959b441ac422

+	golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c // indirect

+	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45

+	golang.org/x/sync v0.0.0-20190423024810-112230192c58

+	golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b

+	golang.org/x/text v0.3.2 // indirect

+	golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c

+	google.golang.org/appengine v1.5.0

+	google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873

+	google.golang.org/grpc v1.20.1

+	honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a

+)

@@ -1,4 +1,4 @@

-// Copyright 2017 Google Inc. All Rights Reserved.

+// Copyright 2017 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -15,28 +15,88 @@

 package internal

 import (

+	"context"

+	"encoding/json"

 	"fmt"

 	"io/ioutil"

-	"golang.org/x/net/context"

+	"golang.org/x/oauth2"

+

 	"golang.org/x/oauth2/google"

 )

 // Creds returns credential information obtained from DialSettings, or if none, then

 // it returns default credential information.

-func Creds(ctx context.Context, ds *DialSettings) (*google.DefaultCredentials, error) {

+func Creds(ctx context.Context, ds *DialSettings) (*google.Credentials, error) {

 	if ds.Credentials != nil {

 		return ds.Credentials, nil

 	}

+	if ds.CredentialsJSON != nil {

+		return credentialsFromJSON(ctx, ds.CredentialsJSON, ds.Endpoint, ds.Scopes, ds.Audiences)

+	}

 	if ds.CredentialsFile != "" {

 		data, err := ioutil.ReadFile(ds.CredentialsFile)

 		if err != nil {

 			return nil, fmt.Errorf("cannot read credentials file: %v", err)

 		}

-		return google.CredentialsFromJSON(ctx, data, ds.Scopes...)

+		return credentialsFromJSON(ctx, data, ds.Endpoint, ds.Scopes, ds.Audiences)

 	}

 	if ds.TokenSource != nil {

-		return &google.DefaultCredentials{TokenSource: ds.TokenSource}, nil

+		return &google.Credentials{TokenSource: ds.TokenSource}, nil

+	}

+	cred, err := google.FindDefaultCredentials(ctx, ds.Scopes...)

+	if err != nil {

+		return nil, err

+	}

+	if len(cred.JSON) > 0 {

+		return credentialsFromJSON(ctx, cred.JSON, ds.Endpoint, ds.Scopes, ds.Audiences)

+	}

+	// For GAE and GCE, the JSON is empty so return the default credentials directly.

+	return cred, nil

+}

+

+// JSON key file type.

+const (

+	serviceAccountKey = "service_account"

+)

+

+// credentialsFromJSON returns a google.Credentials based on the input.

+//

+// - If the JSON is a service account and no scopes provided, returns self-signed JWT auth flow

+// - Otherwise, returns OAuth 2.0 flow.

+func credentialsFromJSON(ctx context.Context, data []byte, endpoint string, scopes []string, audiences []string) (*google.Credentials, error) {

+	cred, err := google.CredentialsFromJSON(ctx, data, scopes...)

+	if err != nil {

+		return nil, err

+	}

+	if len(data) > 0 && len(scopes) == 0 {

+		var f struct {

+			Type string `json:"type"`

+			// The rest JSON fields are omitted because they are not used.

+		}

+		if err := json.Unmarshal(cred.JSON, &f); err != nil {

+			return nil, err

+		}

+		if f.Type == serviceAccountKey {

+			ts, err := selfSignedJWTTokenSource(data, endpoint, audiences)

+			if err != nil {

+				return nil, err

+			}

+			cred.TokenSource = ts

+		}

+	}

+	return cred, err

+}

+

+func selfSignedJWTTokenSource(data []byte, endpoint string, audiences []string) (oauth2.TokenSource, error) {

+	// Use the API endpoint as the default audience

+	audience := endpoint

+	if len(audiences) > 0 {

+		// TODO(shinfan): Update golang oauth to support multiple audiences.

+		if len(audiences) > 1 {

+			return nil, fmt.Errorf("multiple audiences support is not implemented")

+		}

+		audience = audiences[0]

 	}

-	return google.FindDefaultCredentials(ctx, ds.Scopes...)

+	return google.JWTAccessTokenSourceFromJSON(data, audience)

 }

@@ -1,4 +1,4 @@

-// Copyright 2016 Google Inc. All Rights Reserved.

+// Copyright 2016 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -16,6 +16,7 @@ package internal

 import (

 	"errors"

+

 	"google.golang.org/grpc/naming"

 )

@@ -37,7 +38,7 @@ func NewPoolResolver(size int, o *DialSettings) *PoolResolver {

 // provided to NewPoolResolver.

 func (r *PoolResolver) Resolve(target string) (naming.Watcher, error) {

 	if r.dialOpt.Endpoint == "" {

-		return nil, errors.New("No endpoint configured")

+		return nil, errors.New("no endpoint configured")

 	}

 	addrs := make([]*naming.Update, 0, r.poolSize)

 	for i := 0; i < r.poolSize; i++ {

@@ -54,6 +55,7 @@ func (r *PoolResolver) Next() ([]*naming.Update, error) {

 	return <-r.ch, nil

 }

+// Close releases resources associated with the pool and causes Next to unblock.

 func (r *PoolResolver) Close() {

 	close(r.ch)

 }

@@ -1,4 +1,4 @@

-// Copyright 2017 Google Inc. All Rights Reserved.

+// Copyright 2017 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -30,14 +30,21 @@ type DialSettings struct {

 	Endpoint        string

 	Scopes          []string

 	TokenSource     oauth2.TokenSource

-	Credentials     *google.DefaultCredentials

+	Credentials     *google.Credentials

 	CredentialsFile string // if set, Token Source is ignored.

+	CredentialsJSON []byte

 	UserAgent       string

 	APIKey          string

+	Audiences       []string

 	HTTPClient      *http.Client

 	GRPCDialOpts    []grpc.DialOption

 	GRPCConn        *grpc.ClientConn

 	NoAuth          bool

+

+	// Google API system parameters. For more information please read:

+	// https://cloud.google.com/apis/docs/system-parameters

+	QuotaProject  string

+	RequestReason string

 }

 // Validate reports an error if ds is invalid.

@@ -49,7 +56,27 @@ func (ds *DialSettings) Validate() error {

 	// Credentials should not appear with other options.

 	// We currently allow TokenSource and CredentialsFile to coexist.

 	// TODO(jba): make TokenSource & CredentialsFile an error (breaking change).

-	if ds.Credentials != nil && (ds.APIKey != "" || ds.TokenSource != nil || ds.CredentialsFile != "") {

+	nCreds := 0

+	if ds.Credentials != nil {

+		nCreds++

+	}

+	if ds.CredentialsJSON != nil {

+		nCreds++

+	}

+	if ds.CredentialsFile != "" {

+		nCreds++

+	}

+	if ds.APIKey != "" {

+		nCreds++

+	}

+	if ds.TokenSource != nil {

+		nCreds++

+	}

+	if len(ds.Scopes) > 0 && len(ds.Audiences) > 0 {

+		return errors.New("WithScopes is incompatible with WithAudience")

+	}

+	// Accept only one form of credentials, except we allow TokenSource and CredentialsFile for backwards compatibility.

+	if nCreds > 1 && !(nCreds == 2 && ds.TokenSource != nil && ds.CredentialsFile != "") {

 		return errors.New("multiple credential options provided")

 	}

 	if ds.HTTPClient != nil && ds.GRPCConn != nil {

@@ -58,5 +85,12 @@ func (ds *DialSettings) Validate() error {

 	if ds.HTTPClient != nil && ds.GRPCDialOpts != nil {

 		return errors.New("WithHTTPClient is incompatible with gRPC dial options")

 	}

+	if ds.HTTPClient != nil && ds.QuotaProject != "" {

+		return errors.New("WithHTTPClient is incompatible with QuotaProject")

+	}

+	if ds.HTTPClient != nil && ds.RequestReason != "" {

+		return errors.New("WithHTTPClient is incompatible with RequestReason")

+	}

+

 	return nil

 }

@@ -1,4 +1,4 @@

-// Copyright 2016 Google Inc. All Rights Reserved.

+// Copyright 2016 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -1,4 +1,4 @@

-// Copyright 2018 Google Inc. All Rights Reserved.

+// Copyright 2018 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -27,6 +27,7 @@ func (w *withCreds) Apply(o *internal.DialSettings) {

 	o.Credentials = (*google.Credentials)(w)

 }

+// WithCredentials returns a ClientOption that authenticates API calls.

 func WithCredentials(creds *google.Credentials) ClientOption {

 	return (*withCreds)(creds)

 }

@@ -1,4 +1,4 @@

-// Copyright 2018 Google Inc. All Rights Reserved.

+// Copyright 2018 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -1,4 +1,4 @@

-// Copyright 2017 Google Inc. All Rights Reserved.

+// Copyright 2017 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -61,6 +61,20 @@ func WithServiceAccountFile(filename string) ClientOption {

 	return WithCredentialsFile(filename)

 }

+// WithCredentialsJSON returns a ClientOption that authenticates

+// API calls with the given service account or refresh token JSON

+// credentials.

+func WithCredentialsJSON(p []byte) ClientOption {

+	return withCredentialsJSON(p)

+}

+

+type withCredentialsJSON []byte

+

+func (w withCredentialsJSON) Apply(o *internal.DialSettings) {

+	o.CredentialsJSON = make([]byte, len(w))

+	copy(o.CredentialsJSON, w)

+}

+

 // WithEndpoint returns a ClientOption that overrides the default endpoint

 // to be used for a service.

 func WithEndpoint(url string) ClientOption {

@@ -82,9 +96,8 @@ func WithScopes(scope ...string) ClientOption {

 type withScopes []string

 func (w withScopes) Apply(o *internal.DialSettings) {

-	s := make([]string, len(w))

-	copy(s, w)

-	o.Scopes = s

+	o.Scopes = make([]string, len(w))

+	copy(o.Scopes, w)

 }

 // WithUserAgent returns a ClientOption that sets the User-Agent.

@@ -153,6 +166,9 @@ func (w withGRPCConnectionPool) Apply(o *internal.DialSettings) {

 // WithAPIKey returns a ClientOption that specifies an API key to be used

 // as the basis for authentication.

+//

+// API Keys can only be used for JSON-over-HTTP APIs, including those under

+// the import path google.golang.org/api/....

 func WithAPIKey(apiKey string) ClientOption {

 	return withAPIKey(apiKey)

 }

@@ -161,6 +177,19 @@ type withAPIKey string

 func (w withAPIKey) Apply(o *internal.DialSettings) { o.APIKey = string(w) }

+// WithAudiences returns a ClientOption that specifies an audience to be used

+// as the audience field ("aud") for the JWT token authentication.

+func WithAudiences(audience ...string) ClientOption {

+	return withAudiences(audience)

+}

+

+type withAudiences []string

+

+func (w withAudiences) Apply(o *internal.DialSettings) {

+	o.Audiences = make([]string, len(w))

+	copy(o.Audiences, w)

+}

+

 // WithoutAuthentication returns a ClientOption that specifies that no

 // authentication should be used. It is suitable only for testing and for

 // accessing public resources, like public Google Cloud Storage buckets.

@@ -173,3 +202,34 @@ func WithoutAuthentication() ClientOption {

 type withoutAuthentication struct{}

 func (w withoutAuthentication) Apply(o *internal.DialSettings) { o.NoAuth = true }

+

+// WithQuotaProject returns a ClientOption that specifies the project used

+// for quota and billing purposes.

+//

+// For more information please read:

+// https://cloud.google.com/apis/docs/system-parameters

+func WithQuotaProject(quotaProject string) ClientOption {

+	return withQuotaProject(quotaProject)

+}

+

+type withQuotaProject string

+

+func (w withQuotaProject) Apply(o *internal.DialSettings) {

+	o.QuotaProject = string(w)

+}

+

+// WithRequestReason returns a ClientOption that specifies a reason for

+// making the request, which is intended to be recorded in audit logging.

+// An example reason would be a support-case ticket number.

+//

+// For more information please read:

+// https://cloud.google.com/apis/docs/system-parameters

+func WithRequestReason(requestReason string) ClientOption {

+	return withRequestReason(requestReason)

+}

+

+type withRequestReason string

+

+func (w withRequestReason) Apply(o *internal.DialSettings) {

+	o.RequestReason = string(w)

+}

@@ -1,4 +1,4 @@

-// Copyright 2016 Google Inc. All Rights Reserved.

+// Copyright 2016 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -22,13 +22,13 @@

 package bundler

 import (

+	"context"

 	"errors"

 	"math"

 	"reflect"

 	"sync"

 	"time"

-	"golang.org/x/net/context"

 	"golang.org/x/sync/semaphore"

 )

@@ -1,4 +1,4 @@

-// Copyright 2015 Google Inc. All Rights Reserved.

+// Copyright 2015 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -12,15 +12,12 @@

 // See the License for the specific language governing permissions and

 // limitations under the License.

-// Package transport supports network connections to HTTP and GRPC servers.

-// This package is not intended for use by end developers. Use the

-// google.golang.org/api/option package to configure API clients.

 package transport

 import (

+	"context"

 	"net/http"

-	"golang.org/x/net/context"

 	"google.golang.org/grpc"

 	"google.golang.org/api/option"

new file mode 100644

@@ -0,0 +1,21 @@

+// Copyright 2019 Google LLC

+//

+// Licensed under the Apache License, Version 2.0 (the "License");

+// you may not use this file except in compliance with the License.

+// You may obtain a copy of the License at

+//

+//      http://www.apache.org/licenses/LICENSE-2.0

+//

+// Unless required by applicable law or agreed to in writing, software

+// distributed under the License is distributed on an "AS IS" BASIS,

+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+// See the License for the specific language governing permissions and

+// limitations under the License.

+

+// Package transport provides utility methods for creating authenticated

+// transports to Google's HTTP and gRPC APIs. It is intended to be used in

+// conjunction with google.golang.org/api/option.

+//

+// This package is not intended for use by end developers. Use the

+// google.golang.org/api/option package to configure API clients.

+package transport

@@ -1,4 +1,4 @@

-// Copyright 2018 Google Inc. All Rights Reserved.

+// Copyright 2018 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -17,7 +17,8 @@

 package transport

 import (

-	"golang.org/x/net/context"

+	"context"

+

 	"golang.org/x/oauth2/google"

 	"google.golang.org/api/internal"

 	"google.golang.org/api/option"

@@ -1,4 +1,4 @@

-// Copyright 2015 Google Inc. All Rights Reserved.

+// Copyright 2015 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -12,25 +12,37 @@

 // See the License for the specific language governing permissions and

 // limitations under the License.

-// Package transport/grpc supports network connections to GRPC servers.

+// Package grpc supports network connections to GRPC servers.

 // This package is not intended for use by end developers. Use the

 // google.golang.org/api/option package to configure API clients.

 package grpc

 import (

+	"context"

 	"errors"

+	"log"

+	"os"

+	"strings"

-	"golang.org/x/net/context"

+	"go.opencensus.io/plugin/ocgrpc"

+	"golang.org/x/oauth2"

 	"google.golang.org/api/internal"

 	"google.golang.org/api/option"

 	"google.golang.org/grpc"

 	"google.golang.org/grpc/credentials"

+	grpcgoogle "google.golang.org/grpc/credentials/google"

 	"google.golang.org/grpc/credentials/oauth"

+

+	// Install grpclb, which is required for direct path.

+	_ "google.golang.org/grpc/balancer/grpclb"

 )

 // Set at init time by dial_appengine.go. If nil, we're not on App Engine.

 var appengineDialerHook func(context.Context) grpc.DialOption

+// Set at init time by dial_socketopt.go. If nil, socketopt is not supported.

+var timeoutDialerOption grpc.DialOption

+

 // Dial returns a GRPC connection for use communicating with a Google cloud

 // service, configured with the given ClientOptions.

 func Dial(ctx context.Context, opts ...option.ClientOption) (*grpc.ClientConn, error) {

@@ -62,19 +74,47 @@ func dial(ctx context.Context, insecure bool, opts []option.ClientOption) (*grpc

 	if insecure {

 		grpcOpts = []grpc.DialOption{grpc.WithInsecure()}

 	} else if !o.NoAuth {

+		if o.APIKey != "" {

+			log.Print("API keys are not supported for gRPC APIs. Remove the WithAPIKey option from your client-creating call.")

+		}

 		creds, err := internal.Creds(ctx, &o)

 		if err != nil {

 			return nil, err

 		}

-		grpcOpts = []grpc.DialOption{

-			grpc.WithPerRPCCredentials(oauth.TokenSource{creds.TokenSource}),

-			grpc.WithTransportCredentials(credentials.NewClientTLSFromCert(nil, "")),

+		// Attempt Direct Path only if:

+		// * The endpoint is a host:port (or dns:///host:port).

+		// * Credentials are obtained via GCE metadata server, using the default

+		//   service account.

+		// * Opted in via GOOGLE_CLOUD_ENABLE_DIRECT_PATH environment variable.

+		//   For example, GOOGLE_CLOUD_ENABLE_DIRECT_PATH=spanner,pubsub

+		if isDirectPathEnabled(o.Endpoint) && isTokenSourceDirectPathCompatible(creds.TokenSource) {

+			if !strings.HasPrefix(o.Endpoint, "dns:///") {

+				o.Endpoint = "dns:///" + o.Endpoint

+			}

+			grpcOpts = []grpc.DialOption{

+				grpc.WithCredentialsBundle(

+					grpcgoogle.NewComputeEngineCredentials(),

+				),

+			}

+			// TODO(cbro): add support for system parameters (quota project, request reason) via chained interceptor.

+		} else {

+			grpcOpts = []grpc.DialOption{

+				grpc.WithPerRPCCredentials(grpcTokenSource{

+					TokenSource:   oauth.TokenSource{creds.TokenSource},

+					quotaProject:  o.QuotaProject,

+					requestReason: o.RequestReason,

+				}),

+				grpc.WithTransportCredentials(credentials.NewClientTLSFromCert(nil, "")),

+			}

 		}

 	}

+

 	if appengineDialerHook != nil {

 		// Use the Socket API on App Engine.

+		// appengine dialer will override socketopt dialer

 		grpcOpts = append(grpcOpts, appengineDialerHook(ctx))

 	}

+

 	// Add tracing, but before the other options, so that clients can override the

 	// gRPC stats handler.

 	// This assumes that gRPC options are processed in order, left to right.

@@ -83,5 +123,87 @@ func dial(ctx context.Context, insecure bool, opts []option.ClientOption) (*grpc

 	if o.UserAgent != "" {

 		grpcOpts = append(grpcOpts, grpc.WithUserAgent(o.UserAgent))

 	}

+

+	// TODO(weiranf): This socketopt dialer will be used by default at some

+	// point when isDirectPathEnabled will default to true, we guard it by

+	// the Directpath env var for now once we can introspect user defined

+	// dialer (https://github.com/grpc/grpc-go/issues/2795).

+	if timeoutDialerOption != nil && isDirectPathEnabled(o.Endpoint) {

+		grpcOpts = append(grpcOpts, timeoutDialerOption)

+	}

+

 	return grpc.DialContext(ctx, o.Endpoint, grpcOpts...)

 }

+

+func addOCStatsHandler(opts []grpc.DialOption) []grpc.DialOption {

+	return append(opts, grpc.WithStatsHandler(&ocgrpc.ClientHandler{}))

+}

+

+// grpcTokenSource supplies PerRPCCredentials from an oauth.TokenSource.

+type grpcTokenSource struct {

+	oauth.TokenSource

+

+	// Additional metadata attached as headers.

+	quotaProject  string

+	requestReason string

+}

+

+// GetRequestMetadata gets the request metadata as a map from a grpcTokenSource.

+func (ts grpcTokenSource) GetRequestMetadata(ctx context.Context, uri ...string) (

+	map[string]string, error) {

+	metadata, err := ts.TokenSource.GetRequestMetadata(ctx, uri...)

+	if err != nil {

+		return nil, err

+	}

+

+	// Attach system parameter

+	if ts.quotaProject != "" {

+		metadata["X-goog-user-project"] = ts.quotaProject

+	}

+	if ts.requestReason != "" {

+		metadata["X-goog-request-reason"] = ts.requestReason

+	}

+	return metadata, nil

+}

+

+func isTokenSourceDirectPathCompatible(ts oauth2.TokenSource) bool {

+	if ts == nil {

+		return false

+	}

+	tok, err := ts.Token()

+	if err != nil {

+		return false

+	}

+	if tok == nil {

+		return false

+	}

+	if source, _ := tok.Extra("oauth2.google.tokenSource").(string); source != "compute-metadata" {

+		return false

+	}

+	if acct, _ := tok.Extra("oauth2.google.serviceAccount").(string); acct != "default" {

+		return false

+	}

+	return true

+}

+

+func isDirectPathEnabled(endpoint string) bool {

+	// Only host:port is supported, not other schemes (e.g., "tcp://" or "unix://").

+	// Also don't try direct path if the user has chosen an alternate name resolver

+	// (i.e., via ":///" prefix).

+	//

+	// TODO(cbro): once gRPC has introspectible options, check the user hasn't

+	// provided a custom dialer in gRPC options.

+	if strings.Contains(endpoint, "://") && !strings.HasPrefix(endpoint, "dns:///") {

+		return false

+	}

+

+	// Only try direct path if the user has opted in via the environment variable.

+	whitelist := strings.Split(os.Getenv("GOOGLE_CLOUD_ENABLE_DIRECT_PATH"), ",")

+	for _, api := range whitelist {

+		// Ignore empty string since an empty env variable splits into [""]

+		if api != "" && strings.Contains(endpoint, api) {

+			return true

+		}

+	}

+	return false

+}

@@ -1,4 +1,4 @@

-// Copyright 2016 Google Inc. All Rights Reserved.

+// Copyright 2016 Google LLC

 //

 // Licensed under the Apache License, Version 2.0 (the "License");

 // you may not use this file except in compliance with the License.

@@ -17,10 +17,10 @@

 package grpc

 import (

+	"context"

 	"net"

 	"time"

-	"golang.org/x/net/context"

 	"google.golang.org/appengine"

 	"google.golang.org/appengine/socket"

 	"google.golang.org/grpc"

new file mode 100644

@@ -0,0 +1,59 @@

+// Copyright 2019 Google LLC

+//

+// Licensed under the Apache License, Version 2.0 (the "License");

+// you may not use this file except in compliance with the License.

+// You may obtain a copy of the License at

+//

+//      http://www.apache.org/licenses/LICENSE-2.0

+//

+// Unless required by applicable law or agreed to in writing, software

+// distributed under the License is distributed on an "AS IS" BASIS,

+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+// See the License for the specific language governing permissions and

+// limitations under the License.

+

+// +build go1.11,linux

+

+package grpc

+

+import (

+	"context"

+	"net"

+	"syscall"

+

+	"golang.org/x/sys/unix"

+	"google.golang.org/grpc"

+)

+

+const (

+	// defaultTCPUserTimeout is the default TCP_USER_TIMEOUT socket option. By

+	// default is 20 seconds.

+	tcpUserTimeoutMilliseconds = 20000

+)

+

+func init() {

+	// timeoutDialerOption is a grpc.DialOption that contains dialer with

+	// socket option TCP_USER_TIMEOUT. This dialer requires go versions 1.11+.

+	timeoutDialerOption = grpc.WithContextDialer(dialTCPUserTimeout)

+}

+

+func dialTCPUserTimeout(ctx context.Context, addr string) (net.Conn, error) {

+	control := func(network, address string, c syscall.RawConn) error {

+		var syscallErr error

+		controlErr := c.Control(func(fd uintptr) {

+			syscallErr = syscall.SetsockoptInt(

+				int(fd), syscall.IPPROTO_TCP, unix.TCP_USER_TIMEOUT, tcpUserTimeoutMilliseconds)

+		})

+		if syscallErr != nil {

+			return syscallErr

+		}

+		if controlErr != nil {

+			return controlErr

+		}

+		return nil

+	}

+	d := &net.Dialer{

+		Control: control,

+	}

+	return d.DialContext(ctx, "tcp", addr)

+}

deleted file mode 100644

@@ -1,26 +0,0 @@

-// Copyright 2018 Google Inc. All Rights Reserved.

-//

-// Licensed under the Apache License, Version 2.0 (the "License");

-// you may not use this file except in compliance with the License.

-// You may obtain a copy of the License at

-//

-//      http://www.apache.org/licenses/LICENSE-2.0

-//

-// Unless required by applicable law or agreed to in writing, software

-// distributed under the License is distributed on an "AS IS" BASIS,

-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

-// See the License for the specific language governing permissions and