Merge pull request #460 from Gouthamve/crd

Move to CRDs

Documentation/rbac.md

@@ -20,7 +20,13 @@ rules:
   resources:
   - thirdpartyresources
   verbs:
-  - create
+  - "*" 
+- apiGroups:
+  - apiextensions.k8s.io 
+  resources:
+  - customresourcedefinitions 
+  verbs:
+  - "*" 
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -52,6 +58,10 @@ rules:
   resources:
   - nodes
   verbs: ["list", "watch"]
+- apiGroups: [""]
+  resources:
+  - namespaces 
+  verbs: ["list"]
 ```
 
 > Note: A cluster admin is required to create this `ClusterRole` and create a `ClusterRoleBinding` or `RoleBinding` to the `ServiceAccount` used by the Prometheus Operator `Pod`. The `ServiceAccount` used by the Prometheus Operator `Pod` can be specified in the `Deployment` object used to deploy it.

Documentation/user-guides/getting-started.md

@@ -31,7 +31,13 @@ rules:
   resources:
   - thirdpartyresources
   verbs:
-  - create
+  - "*" 
+- apiGroups:
+  - apiextensions.k8s.io 
+  resources:
+  - customresourcedefinitions 
+  verbs:
+  - "*" 
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -63,6 +69,10 @@ rules:
   resources:
   - nodes
   verbs: ["list", "watch"]
+- apiGroups: [""]
+  resources:
+  - namespaces 
+  verbs: ["list"]
 ---
 apiVersion: v1
 kind: ServiceAccount

Makefile

@@ -29,6 +29,7 @@ container:
 	docker build -t $(REPO):$(TAG) .
 
 e2e-test:
+	go test -timeout 20m -v ./test/migration/ $(TEST_RUN_ARGS) --kubeconfig=$(KUBECONFIG) --operator-image=$(REPO):$(TAG) --namespace=$(NAMESPACE)
 	go test -timeout 20m -v ./test/e2e/ $(TEST_RUN_ARGS) --kubeconfig=$(KUBECONFIG) --operator-image=$(REPO):$(TAG) --namespace=$(NAMESPACE)
 
 e2e-status:

bundle.yaml

@@ -21,7 +21,13 @@ rules:
   resources:
   - thirdpartyresources
   verbs:
-  - create
+  - "*" 
+- apiGroups:
+  - apiextensions.k8s.io 
+  resources:
+  - customresourcedefinitions 
+  verbs:
+  - "*" 
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -53,6 +59,10 @@ rules:
   resources:
   - nodes
   verbs: ["list", "watch"]
+- apiGroups: [""]
+  resources:
+  - namespaces 
+  verbs: ["list"]
 ---
 apiVersion: v1
 kind: ServiceAccount

cmd/operator/main.go

@@ -32,6 +32,8 @@ import (
 	"github.com/coreos/prometheus-operator/pkg/alertmanager"
 	"github.com/coreos/prometheus-operator/pkg/analytics"
 	"github.com/coreos/prometheus-operator/pkg/api"
+	"github.com/coreos/prometheus-operator/pkg/k8sutil"
+	"github.com/coreos/prometheus-operator/pkg/migrator"
 	prometheuscontroller "github.com/coreos/prometheus-operator/pkg/prometheus"
 	"github.com/go-kit/kit/log"
 )
@@ -99,13 +101,34 @@ func Main() int {
 	po.RegisterMetrics(r)
 	ao.RegisterMetrics(r)
 	mux.Handle("/metrics", promhttp.HandlerFor(r, promhttp.HandlerOpts{}))
-
 	mux.Handle("/debug/pprof/", http.HandlerFunc(pprof.Index))
 	mux.Handle("/debug/pprof/cmdline", http.HandlerFunc(pprof.Cmdline))
 	mux.Handle("/debug/pprof/profile", http.HandlerFunc(pprof.Profile))
 	mux.Handle("/debug/pprof/symbol", http.HandlerFunc(pprof.Symbol))
 	mux.Handle("/debug/pprof/trace", http.HandlerFunc(pprof.Trace))
 
+	conf, err := k8sutil.NewClusterConfig(cfg.Host, cfg.TLSInsecure, &cfg.TLSConfig)
+	if err != nil {
+		fmt.Fprint(os.Stderr, err)
+		return 1
+	}
+
+	mg, err := migrator.GetMigration(conf, logger.With("component", "migrator"))
+	if err != nil {
+		fmt.Fprint(os.Stderr, err)
+		return 1
+	}
+
+	switch mg {
+	case migrator.TPR2CRD:
+		err = migrator.MigrateTPR2CRD(conf, logger.With("component", "migrator"))
+		if err != nil {
+			fmt.Fprint(os.Stderr, err)
+			return 1
+		}
+	default:
+	}
+
 	ctx, cancel := context.WithCancel(context.Background())
 	wg, ctx := errgroup.WithContext(ctx)
 

example/rbac/prometheus-operator/prometheus-operator-cluster-role.yaml

@@ -8,7 +8,13 @@ rules:
   resources:
   - thirdpartyresources
   verbs:
-  - create
+  - "*" 
+- apiGroups:
+  - apiextensions.k8s.io 
+  resources:
+  - customresourcedefinitions 
+  verbs:
+  - "*" 
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -40,3 +46,7 @@ rules:
   resources:
   - nodes
   verbs: ["list", "watch"]
+- apiGroups: [""]
+  resources:
+  - namespaces 
+  verbs: ["list"]

pkg/alertmanager/operator.go

@@ -29,6 +29,8 @@ import (
 	"github.com/go-kit/kit/log"
 	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
+	extensionsobj "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -39,12 +41,12 @@ import (
 	"k8s.io/client-go/pkg/api"
 	"k8s.io/client-go/pkg/api/v1"
 	"k8s.io/client-go/pkg/apis/apps/v1beta1"
-	extensionsobj "k8s.io/client-go/pkg/apis/extensions/v1beta1"
+	extensionsobjold "k8s.io/client-go/pkg/apis/extensions/v1beta1"
 	"k8s.io/client-go/tools/cache"
 )
 
 const (
-	tprAlertmanager = "alertmanager." + v1alpha1.TPRGroup
+	crdAlertmanager = v1alpha1.AlertmanagerName + "." + v1alpha1.Group
 
 	resyncPeriod = 5 * time.Minute
 )
@@ -52,9 +54,10 @@ const (
 // Operator manages lify cycle of Alertmanager deployments and
 // monitoring configurations.
 type Operator struct {
-	kclient *kubernetes.Clientset
-	mclient *v1alpha1.MonitoringV1alpha1Client
-	logger  log.Logger
+	kclient   *kubernetes.Clientset
+	mclient   *v1alpha1.MonitoringV1alpha1Client
+	crdclient apiextensionsclient.Interface
+	logger    log.Logger
 
 	alrtInf cache.SharedIndexInformer
 	ssetInf cache.SharedIndexInformer
@@ -76,6 +79,7 @@ func New(c prometheusoperator.Config, logger log.Logger) (*Operator, error) {
 	if err != nil {
 		return nil, errors.Wrap(err, "instantiating cluster config failed")
 	}
+
 	client, err := kubernetes.NewForConfig(cfg)
 	if err != nil {
 		return nil, errors.Wrap(err, "instantiating kubernetes client failed")
@@ -86,12 +90,18 @@ func New(c prometheusoperator.Config, logger log.Logger) (*Operator, error) {
 		return nil, errors.Wrap(err, "instantiating monitoring client failed")
 	}
 
+	crdclient, err := apiextensionsclient.NewForConfig(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "instantiating apiextensions client failed")
+	}
+
 	o := &Operator{
-		kclient: client,
-		mclient: mclient,
-		logger:  logger,
-		queue:   workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "alertmanager"),
-		config:  Config{Host: c.Host, ConfigReloaderImage: c.ConfigReloaderImage, AlertmanagerDefaultBaseImage: c.AlertmanagerDefaultBaseImage},
+		kclient:   client,
+		mclient:   mclient,
+		crdclient: crdclient,
+		logger:    logger,
+		queue:     workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "alertmanager"),
+		config:    Config{Host: c.Host, ConfigReloaderImage: c.ConfigReloaderImage, AlertmanagerDefaultBaseImage: c.AlertmanagerDefaultBaseImage},
 	}
 
 	o.alrtInf = cache.NewSharedIndexInformer(
@@ -137,7 +147,18 @@ func (c *Operator) Run(stopc <-chan struct{}) error {
 		}
 		c.logger.Log("msg", "connection established", "cluster-version", v)
 
-		if err := c.createTPRs(); err != nil {
+		mv, err := k8sutil.GetMinorVersion(c.kclient.Discovery())
+		if mv < 7 {
+			if err := c.createTPRs(); err != nil {
+				errChan <- errors.Wrap(err, "creating TPRs failed")
+				return
+			}
+
+			errChan <- nil
+			return
+		}
+
+		if err := c.createCRDs(); err != nil {
 			errChan <- err
 			return
 		}
@@ -149,7 +170,7 @@ func (c *Operator) Run(stopc <-chan struct{}) error {
 		if err != nil {
 			return err
 		}
-		c.logger.Log("msg", "TPR API endpoints ready")
+		c.logger.Log("msg", "CRD API endpoints ready")
 	case <-stopc:
 		return nil
 	}
@@ -540,14 +561,45 @@ func (c *Operator) destroyAlertmanager(key string) error {
 	return nil
 }
 
-func (c *Operator) createTPRs() error {
-	tprs := []*extensionsobj.ThirdPartyResource{
+func (c *Operator) createCRDs() error {
+	crds := []*extensionsobj.CustomResourceDefinition{
 		{
 			ObjectMeta: metav1.ObjectMeta{
-				Name: tprAlertmanager,
+				Name: crdAlertmanager,
 			},
-			Versions: []extensionsobj.APIVersion{
-				{Name: v1alpha1.TPRVersion},
+			Spec: extensionsobj.CustomResourceDefinitionSpec{
+				Group:   v1alpha1.Group,
+				Version: v1alpha1.Version,
+				Scope:   extensionsobj.NamespaceScoped,
+				Names: extensionsobj.CustomResourceDefinitionNames{
+					Plural: v1alpha1.AlertmanagerName,
+					Kind:   v1alpha1.AlertmanagersKind,
+				},
+			},
+		},
+	}
+
+	crdClient := c.crdclient.ApiextensionsV1beta1().CustomResourceDefinitions()
+
+	for _, crd := range crds {
+		if _, err := crdClient.Create(crd); err != nil && !apierrors.IsAlreadyExists(err) {
+			return errors.Wrapf(err, "Creating CRD: %s", crd.Spec.Names.Kind)
+		}
+		c.logger.Log("msg", "CRD created", "crd", crd.Spec.Names.Kind)
+	}
+
+	// We have to wait for the CRDs to be ready. Otherwise the initial watch may fail.
+	return k8sutil.WaitForCRDReady(c.kclient.CoreV1().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.AlertmanagerName)
+}
+
+func (c *Operator) createTPRs() error {
+	tprs := []*extensionsobjold.ThirdPartyResource{
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "alertmanager." + v1alpha1.Group,
+			},
+			Versions: []extensionsobjold.APIVersion{
+				{Name: v1alpha1.Version},
 			},
 			Description: "Managed Alertmanager cluster",
 		},
@@ -562,5 +614,5 @@ func (c *Operator) createTPRs() error {
 	}
 
 	// We have to wait for the TPRs to be ready. Otherwise the initial watch may fail.
-	return k8sutil.WaitForTPRReady(c.kclient.CoreV1().RESTClient(), v1alpha1.TPRGroup, v1alpha1.TPRVersion, v1alpha1.TPRAlertmanagerName)
+	return k8sutil.WaitForCRDReady(c.kclient.CoreV1().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.AlertmanagerName)
 }

pkg/client/monitoring/v1alpha1/alertmanager.go

@@ -17,6 +17,8 @@ package v1alpha1
 import (
 	"encoding/json"
 
+	"github.com/pkg/errors"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -26,8 +28,8 @@ import (
 )
 
 const (
-	TPRAlertmanagersKind = "Alertmanager"
-	TPRAlertmanagerName  = "alertmanagers"
+	AlertmanagersKind = "Alertmanager"
+	AlertmanagerName  = "alertmanagers"
 )
 
 type AlertmanagersGetter interface {
@@ -54,8 +56,8 @@ func newAlertmanagers(r rest.Interface, c *dynamic.Client, namespace string) *al
 		r,
 		c.Resource(
 			&metav1.APIResource{
-				Kind:       TPRAlertmanagersKind,
-				Name:       TPRAlertmanagerName,
+				Kind:       AlertmanagersKind,
+				Name:       AlertmanagerName,
 				Namespaced: true,
 			},
 			namespace,
@@ -92,6 +94,12 @@ func (a *alertmanagers) Update(o *Alertmanager) (*Alertmanager, error) {
 		return nil, err
 	}
 
+	cura, err := a.Get(o.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to get current version for update")
+	}
+	ua.SetResourceVersion(cura.ObjectMeta.ResourceVersion)
+
 	ua, err = a.client.Update(ua)
 	if err != nil {
 		return nil, err
@@ -146,15 +154,15 @@ func AlertmanagerFromUnstructured(r *unstructured.Unstructured) (*Alertmanager,
 	if err := json.Unmarshal(b, &a); err != nil {
 		return nil, err
 	}
-	a.TypeMeta.Kind = TPRAlertmanagersKind
-	a.TypeMeta.APIVersion = TPRGroup + "/" + TPRVersion
+	a.TypeMeta.Kind = AlertmanagersKind
+	a.TypeMeta.APIVersion = Group + "/" + Version
 	return &a, nil
 }
 
 // UnstructuredFromAlertmanager marshals an Alertmanager object into dynamic client's unstructured
 func UnstructuredFromAlertmanager(a *Alertmanager) (*unstructured.Unstructured, error) {
-	a.TypeMeta.Kind = TPRAlertmanagersKind
-	a.TypeMeta.APIVersion = TPRGroup + "/" + TPRVersion
+	a.TypeMeta.Kind = AlertmanagersKind
+	a.TypeMeta.APIVersion = Group + "/" + Version
 	b, err := json.Marshal(a)
 	if err != nil {
 		return nil, err

pkg/client/monitoring/v1alpha1/client.go

@@ -23,8 +23,8 @@ import (
 )
 
 const (
-	TPRGroup   = "monitoring.coreos.com"
-	TPRVersion = "v1alpha1"
+	Group   = "monitoring.coreos.com"
+	Version = "v1alpha1"
 )
 
 type MonitoringV1alpha1Interface interface {
@@ -73,8 +73,8 @@ func NewForConfig(c *rest.Config) (*MonitoringV1alpha1Client, error) {
 
 func setConfigDefaults(config *rest.Config) {
 	config.GroupVersion = &schema.GroupVersion{
-		Group:   TPRGroup,
-		Version: TPRVersion,
+		Group:   Group,
+		Version: Version,
 	}
 	config.APIPath = "/apis"
 	config.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: api.Codecs}

pkg/client/monitoring/v1alpha1/prometheus.go

@@ -17,6 +17,8 @@ package v1alpha1
 import (
 	"encoding/json"
 
+	"github.com/pkg/errors"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -26,8 +28,9 @@ import (
 )
 
 const (
-	TPRPrometheusesKind = "Prometheus"
-	TPRPrometheusName   = "prometheuses"
+	PrometheusesKind = "Prometheus"
+	PrometheusName   = "prometheuses"
+	PrometheusShort  = "prom"
 )
 
 type PrometheusesGetter interface {
@@ -54,8 +57,8 @@ func newPrometheuses(r rest.Interface, c *dynamic.Client, namespace string) *pro
 		r,
 		c.Resource(
 			&metav1.APIResource{
-				Kind:       TPRPrometheusesKind,
-				Name:       TPRPrometheusName,
+				Kind:       PrometheusesKind,
+				Name:       PrometheusName,
 				Namespaced: true,
 			},
 			namespace,
@@ -92,6 +95,12 @@ func (p *prometheuses) Update(o *Prometheus) (*Prometheus, error) {
 		return nil, err
 	}
 
+	curp, err := p.Get(o.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to get current version for update")
+	}
+	up.SetResourceVersion(curp.ObjectMeta.ResourceVersion)
+
 	up, err = p.client.Update(up)
 	if err != nil {
 		return nil, err
@@ -146,15 +155,15 @@ func PrometheusFromUnstructured(r *unstructured.Unstructured) (*Prometheus, erro
 	if err := json.Unmarshal(b, &p); err != nil {
 		return nil, err
 	}
-	p.TypeMeta.Kind = TPRPrometheusesKind
-	p.TypeMeta.APIVersion = TPRGroup + "/" + TPRVersion
+	p.TypeMeta.Kind = PrometheusesKind
+	p.TypeMeta.APIVersion = Group + "/" + Version
 	return &p, nil
 }
 
 // UnstructuredFromPrometheus marshals a Prometheus object into dynamic client's unstructured
 func UnstructuredFromPrometheus(p *Prometheus) (*unstructured.Unstructured, error) {
-	p.TypeMeta.Kind = TPRPrometheusesKind
-	p.TypeMeta.APIVersion = TPRGroup + "/" + TPRVersion
+	p.TypeMeta.Kind = PrometheusesKind
+	p.TypeMeta.APIVersion = Group + "/" + Version
 	b, err := json.Marshal(p)
 	if err != nil {
 		return nil, err

pkg/client/monitoring/v1alpha1/servicemonitor.go

@@ -17,6 +17,8 @@ package v1alpha1
 import (
 	"encoding/json"
 
+	"github.com/pkg/errors"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -26,8 +28,8 @@ import (
 )
 
 const (
-	TPRServiceMonitorsKind = "ServiceMonitor"
-	TPRServiceMonitorName  = "servicemonitors"
+	ServiceMonitorsKind = "ServiceMonitor"
+	ServiceMonitorName  = "servicemonitors"
 )
 
 type ServiceMonitorsGetter interface {
@@ -54,8 +56,8 @@ func newServiceMonitors(r rest.Interface, c *dynamic.Client, namespace string) *
 		r,
 		c.Resource(
 			&metav1.APIResource{
-				Kind:       TPRServiceMonitorsKind,
-				Name:       TPRServiceMonitorName,
+				Kind:       ServiceMonitorsKind,
+				Name:       ServiceMonitorName,
 				Namespaced: true,
 			},
 			namespace,
@@ -92,6 +94,12 @@ func (s *servicemonitors) Update(o *ServiceMonitor) (*ServiceMonitor, error) {
 		return nil, err
 	}
 
+	curs, err := s.Get(o.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to get current version for update")
+	}
+	us.SetResourceVersion(curs.ObjectMeta.ResourceVersion)
+
 	us, err = s.client.Update(us)
 	if err != nil {
 		return nil, err
@@ -146,15 +154,15 @@ func ServiceMonitorFromUnstructured(r *unstructured.Unstructured) (*ServiceMonit
 	if err := json.Unmarshal(b, &s); err != nil {
 		return nil, err
 	}
-	s.TypeMeta.Kind = TPRServiceMonitorsKind
-	s.TypeMeta.APIVersion = TPRGroup + "/" + TPRVersion
+	s.TypeMeta.Kind = ServiceMonitorsKind
+	s.TypeMeta.APIVersion = Group + "/" + Version
 	return &s, nil
 }
 
 // UnstructuredFromServiceMonitor marshals a ServiceMonitor object into dynamic client's unstructured
 func UnstructuredFromServiceMonitor(s *ServiceMonitor) (*unstructured.Unstructured, error) {
-	s.TypeMeta.Kind = TPRServiceMonitorsKind
-	s.TypeMeta.APIVersion = TPRGroup + "/" + TPRVersion
+	s.TypeMeta.Kind = ServiceMonitorsKind
+	s.TypeMeta.APIVersion = Group + "/" + Version
 	b, err := json.Marshal(s)
 	if err != nil {
 		return nil, err

pkg/k8sutil/k8sutil.go

@@ -20,20 +20,23 @@ import (
 	"net/url"
 	"time"
 
+	version "github.com/hashicorp/go-version"
 	"github.com/pkg/errors"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/discovery"
 	clientv1 "k8s.io/client-go/kubernetes/typed/core/v1"
 	"k8s.io/client-go/pkg/api/v1"
 	"k8s.io/client-go/rest"
 )
 
-// WaitForTPRReady waits for a third party resource to be available
+// WaitForCRDReady waits for a third party resource to be available
 // for use.
-func WaitForTPRReady(restClient rest.Interface, tprGroup, tprVersion, tprName string) error {
+// TODO(gouthamve): Move to clientset.Get()
+func WaitForCRDReady(restClient rest.Interface, crdGroup, crdVersion, crdName string) error {
 	err := wait.Poll(3*time.Second, 5*time.Minute, func() (bool, error) {
-		res := restClient.Get().AbsPath("apis", tprGroup, tprVersion, tprName).Do()
+		res := restClient.Get().AbsPath("apis", crdGroup, crdVersion, crdName).Do()
 		err := res.Error()
 		if err != nil {
 			// RESTClient returns *apierrors.StatusError for any status codes < 200 or > 206
@@ -55,7 +58,7 @@ func WaitForTPRReady(restClient rest.Interface, tprGroup, tprVersion, tprName st
 		return true, nil
 	})
 
-	return errors.Wrap(err, fmt.Sprintf("timed out waiting for TPR %s", tprName))
+	return errors.Wrap(err, fmt.Sprintf("timed out waiting for TPR %s", crdName))
 }
 
 // PodRunningAndReady returns whether a pod is running and each container has
@@ -157,3 +160,18 @@ func CreateOrUpdateEndpoints(eclient clientv1.EndpointsInterface, eps *v1.Endpoi
 
 	return nil
 }
+
+// GetMinorVersion returns the minor version as an integer
+func GetMinorVersion(dclient discovery.DiscoveryInterface) (int, error) {
+	v, err := dclient.ServerVersion()
+	if err != nil {
+		return 0, err
+	}
+
+	ver, err := version.NewVersion(v.String())
+	if err != nil {
+		return 0, err
+	}
+
+	return ver.Segments()[1], nil
+}

pkg/migrator/migrator.go

@@ -0,0 +1,461 @@
+package migrator
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"time"
+
+	"github.com/coreos/prometheus-operator/pkg/client/monitoring/v1alpha1"
+	"github.com/coreos/prometheus-operator/pkg/k8sutil"
+	"github.com/go-kit/kit/log"
+	"github.com/pkg/errors"
+
+	extensionsobj "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	extensionsobjtypes "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+	extensionsobjoldtypes "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
+	"k8s.io/client-go/pkg/api"
+	"k8s.io/client-go/pkg/api/v1"
+	extensionsobjold "k8s.io/client-go/pkg/apis/extensions/v1beta1"
+	"k8s.io/client-go/rest"
+)
+
+const (
+	cmPrometheus     = "crd-migrate-prometheus"
+	cmServiceMonitor = "crd-migrate-servicemonitor"
+	cmAlertmanager   = "crd-migrate-alertmanager"
+)
+
+type migrationState struct {
+	backedUp   bool
+	tprDataDel bool
+	tprRegDel  bool
+
+	crdCreated bool
+	finished   bool
+}
+
+const (
+	NoMigration = iota
+	TPR2CRD
+)
+
+type Migrator struct {
+	cmClient   corev1.ConfigMapInterface
+	dynClient  *dynamic.Client
+	restClient rest.Interface
+	crdClient  extensionsobjtypes.CustomResourceDefinitionInterface
+	tprClient  extensionsobjoldtypes.ThirdPartyResourceInterface
+	nsClient   corev1.NamespaceInterface
+
+	migrated map[string]*migrationState
+
+	cmSuffix string
+	logger   log.Logger
+}
+
+func GetMigration(cfg *rest.Config, logger log.Logger) (int, error) {
+	client, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		return NoMigration, err
+	}
+
+	mv, err := k8sutil.GetMinorVersion(client.Discovery())
+	if err != nil {
+		return NoMigration, err
+	}
+	if mv >= 7 {
+		// See if the TPRs managed by this operator exist.
+		tprClient := client.Extensions().ThirdPartyResources()
+		_, err = tprClient.Get("prometheus."+v1alpha1.Group, metav1.GetOptions{})
+		if err == nil {
+			return TPR2CRD, nil
+		}
+		_, err = tprClient.Get("service-monitor."+v1alpha1.Group, metav1.GetOptions{})
+		if err == nil {
+			return TPR2CRD, nil
+		}
+		_, err = tprClient.Get("alertmanager."+v1alpha1.Group, metav1.GetOptions{})
+		if err == nil {
+			return TPR2CRD, nil
+		}
+	}
+
+	return NoMigration, nil
+}
+
+func NewMigrator(cfg *rest.Config, logger log.Logger) (*Migrator, error) {
+	m := &Migrator{
+		migrated: make(map[string]*migrationState),
+		logger:   logger,
+		cmSuffix: strconv.FormatInt(time.Now().Unix(), 10),
+	}
+
+	kclient, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "creating kubernetes client")
+	}
+
+	restClient, err := rest.RESTClientFor(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "creating rest client")
+	}
+	cmClient := kclient.CoreV1().ConfigMaps("default")
+	dynClient, err := dynamic.NewClient(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "creating a dynamic client")
+	}
+	extClient, err := apiextensionsclient.NewForConfig(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "instantiating apiextensions client")
+	}
+	crdClient := extClient.ApiextensionsV1beta1().CustomResourceDefinitions()
+	tprClient := kclient.ExtensionsV1beta1().ThirdPartyResources()
+
+	m.dynClient = dynClient
+	m.crdClient = crdClient
+	m.restClient = restClient
+	m.tprClient = tprClient
+	m.cmClient = cmClient
+	m.nsClient = kclient.CoreV1().Namespaces()
+
+	return m, nil
+}
+
+func MigrateTPR2CRD(cfg *rest.Config, logger log.Logger) error {
+	cfg.GroupVersion = &schema.GroupVersion{
+		Group:   v1alpha1.Group,
+		Version: v1alpha1.Version,
+	}
+	cfg.APIPath = "/apis"
+	cfg.NegotiatedSerializer = serializer.DirectCodecFactory{CodecFactory: api.Codecs}
+
+	m, err := NewMigrator(cfg, logger)
+	if err != nil {
+		return errors.Wrap(err, "creating the migrator")
+	}
+
+	_, err = m.tprClient.Get("prometheus."+v1alpha1.Group, metav1.GetOptions{})
+	if err == nil {
+		if err := m.MigratePrometheus(); err != nil {
+			logger.Log("error", err)
+			return m.Rollback()
+		}
+	}
+
+	_, err = m.tprClient.Get("service-monitor."+v1alpha1.Group, metav1.GetOptions{})
+	if err == nil {
+		if err := m.MigrateServiceMonitor(); err != nil {
+			logger.Log("error", err)
+			return m.Rollback()
+		}
+	}
+
+	_, err = m.tprClient.Get("alertmanager."+v1alpha1.Group, metav1.GetOptions{})
+	if err == nil {
+		if err := m.MigrateAlertmanager(); err != nil {
+			logger.Log("error", err)
+			return m.Rollback()
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) migrateTPR(tprKind, tprName, tprOldReg, configmap string, shortNames []string) error {
+	m.logger.Log("msg", fmt.Sprintf("migrating TPR \"%s\"", tprKind))
+
+	m.migrated[tprKind] = new(migrationState)
+
+	err := m.moveTPRDataToCM(tprName, configmap)
+	if err != nil {
+		return errors.Wrapf(err, "error moving \"%s\" TPR data to config-map \"%s\"", tprKind, configmap)
+	}
+	m.migrated[tprKind].backedUp = true
+
+	err = m.deleteTPRData(tprKind, tprName)
+	if err != nil {
+		return errors.Wrapf(err, "deleting TPR Data for \"%s\"", tprKind)
+	}
+	m.migrated[tprKind].tprDataDel = true
+
+	err = m.deleteTPR(tprOldReg + "." + v1alpha1.Group)
+	if err != nil {
+		return errors.Wrapf(err, "deleting TPR registration for \"%s\"", tprKind)
+	}
+	m.migrated[tprKind].tprRegDel = true
+
+	crd := &extensionsobj.CustomResourceDefinition{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: tprName + "." + v1alpha1.Group,
+		},
+		Spec: extensionsobj.CustomResourceDefinitionSpec{
+			Group:   v1alpha1.Group,
+			Version: v1alpha1.Version,
+			Scope:   extensionsobj.NamespaceScoped,
+			Names: extensionsobj.CustomResourceDefinitionNames{
+				Plural:     tprName,
+				Kind:       tprKind,
+				ShortNames: shortNames,
+			},
+		},
+	}
+	err = m.createCRD(crd)
+	if err != nil {
+		return errors.Wrapf(err, "error creating CRD registration for \"%s\"", tprKind)
+	}
+	m.migrated[tprKind].crdCreated = true
+
+	err = wait.Poll(500*time.Millisecond, 60*time.Second, func() (bool, error) {
+		crdEst, err := m.crdClient.Get(crd.ObjectMeta.Name, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		for _, cond := range crdEst.Status.Conditions {
+			switch cond.Type {
+			case extensionsobj.Established:
+				if cond.Status == extensionsobj.ConditionTrue {
+					return true, err
+				}
+			case extensionsobj.NamesAccepted:
+				if cond.Status == extensionsobj.ConditionFalse {
+					fmt.Printf("Name conflict: %v\n", cond.Reason)
+				}
+			}
+		}
+		return false, err
+	})
+
+	if err != nil {
+		return errors.Wrapf(err, "error waiting for ready CRD registration for \"%s\"", tprKind, configmap)
+	}
+
+	err = m.restoreFromCM(tprKind, tprName, configmap)
+	if err != nil {
+		return errors.Wrapf(err, "error restoring \"%s\" CRs from \"%s\"", tprKind, configmap)
+	}
+
+	m.migrated[tprKind].finished = true
+
+	return nil
+}
+
+func (m *Migrator) MigratePrometheus() error {
+	return m.migrateTPR(v1alpha1.PrometheusesKind, v1alpha1.PrometheusName, "prometheus", cmPrometheus, []string{v1alpha1.PrometheusShort})
+}
+
+func (m *Migrator) MigrateServiceMonitor() error {
+	return m.migrateTPR(v1alpha1.ServiceMonitorsKind, v1alpha1.ServiceMonitorName, "service-monitor", cmServiceMonitor, nil)
+}
+
+func (m *Migrator) MigrateAlertmanager() error {
+	return m.migrateTPR(v1alpha1.AlertmanagersKind, v1alpha1.AlertmanagerName, "alertmanager", cmAlertmanager, nil)
+}
+
+func (m *Migrator) Rollback() error {
+	if err := m.rollback(
+		v1alpha1.PrometheusesKind,
+		v1alpha1.PrometheusName,
+		cmPrometheus,
+		&extensionsobjold.ThirdPartyResource{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "prometheus." + v1alpha1.Group,
+			},
+			Versions: []extensionsobjold.APIVersion{
+				{Name: v1alpha1.Version},
+			},
+			Description: "Managed Prometheus server",
+		},
+	); err != nil {
+		return errors.Wrap(err, "rollback for Prometheus TPR")
+	}
+
+	if err := m.rollback(
+		v1alpha1.ServiceMonitorsKind,
+		v1alpha1.ServiceMonitorName,
+		cmServiceMonitor,
+		&extensionsobjold.ThirdPartyResource{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "service-monitor." + v1alpha1.Group,
+			},
+			Versions: []extensionsobjold.APIVersion{
+				{Name: v1alpha1.Version},
+			},
+			Description: "Prometheus monitoring for a service",
+		},
+	); err != nil {
+		return errors.Wrap(err, "rollback for ServiceMonitor TPR")
+	}
+
+	if err := m.rollback(
+		v1alpha1.AlertmanagersKind,
+		v1alpha1.AlertmanagerName,
+		cmAlertmanager,
+		&extensionsobjold.ThirdPartyResource{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "alertmanager." + v1alpha1.Group,
+			},
+			Versions: []extensionsobjold.APIVersion{
+				{Name: v1alpha1.Version},
+			},
+			Description: "Managed Alertmanager cluster",
+		},
+	); err != nil {
+		return errors.Wrap(err, "rollback for Alertmanager TPR")
+	}
+
+	return nil
+}
+
+func (m *Migrator) rollback(tprKind, tprName, configmapName string, tpr *extensionsobjold.ThirdPartyResource) error {
+	if ms, ok := m.migrated[tprKind]; ok {
+		if ms.finished {
+			err := m.deleteTPRData(tprKind, tprName)
+			if err != nil {
+				return errors.Wrapf(err, "deleting the CRD data for \"%s\"", tprKind)
+			}
+		}
+
+		if ms.crdCreated {
+			err := m.deleteCRD(tprName + "." + v1alpha1.Group)
+			if err != nil {
+				return errors.Wrapf(err, "deleting the CRD registration for \"%s\"", tprKind)
+			}
+		}
+
+		if ms.tprRegDel {
+			_, err := m.tprClient.Create(tpr)
+			if err != nil {
+				return errors.Wrapf(err, "recreating the TPR registration for \"%s\"", tprKind)
+			}
+		}
+
+		if ms.tprDataDel {
+			err := m.restoreFromCM(tprKind, tprName, configmapName)
+			if err != nil {
+				return errors.Wrapf(
+					err,
+					"recreating the TPR data for \"%s\" from config-map \"%s\"",
+					tprKind, configmapName)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) moveTPRDataToCM(tprName, configmapName string) error {
+	if m.cmSuffix != "" {
+		configmapName = configmapName + "-" + m.cmSuffix
+	}
+
+	req := m.restClient.Get().
+		Namespace(api.NamespaceAll).
+		Resource(tprName).
+		FieldsSelectorParam(nil)
+
+	tprdata, err := req.DoRaw()
+	if err != nil {
+		return nil
+	}
+
+	cm := v1.ConfigMap{}
+
+	cm.ObjectMeta.SetNamespace("default")
+	cm.ObjectMeta.SetName(configmapName)
+
+	cm.Data = map[string]string{"backup": string(tprdata)}
+
+	_, err = m.cmClient.Create(&cm)
+	return err
+}
+
+func (m *Migrator) deleteTPR(tprName string) error {
+	return m.tprClient.Delete(tprName, &metav1.DeleteOptions{})
+}
+
+func (m *Migrator) deleteCRD(crdName string) error {
+	return m.crdClient.Delete(crdName, &metav1.DeleteOptions{})
+}
+
+func (m *Migrator) createCRD(crd *extensionsobj.CustomResourceDefinition) error {
+	_, err := m.crdClient.Create(crd)
+	if err != nil && !apierrors.IsAlreadyExists(err) {
+		return errors.Wrapf(err, "Creating CRD: %s", crd.Spec.Names.Kind)
+	}
+
+	return nil
+}
+
+func (m *Migrator) restoreFromCM(tprKind, tprName, configmapName string) error {
+	if m.cmSuffix != "" {
+		configmapName = configmapName + "-" + m.cmSuffix
+	}
+
+	cm, err := m.cmClient.Get(configmapName, metav1.GetOptions{})
+	if err != nil {
+		return errors.Wrap(err, "creating config map client")
+	}
+
+	tprdata := cm.Data["backup"]
+
+	us := &unstructured.UnstructuredList{}
+	err = json.Unmarshal([]byte(tprdata), us)
+	if err != nil {
+		return errors.Wrap(err, "unmarshalling into UnstructuredList")
+	}
+
+	for _, item := range us.Items {
+		item.SetResourceVersion("") // TODO(gouthamve): HACK?? Best practices
+		// Namespace issues
+		resClient := m.dynClient.Resource(
+			&metav1.APIResource{
+				Kind:       tprKind,
+				Name:       tprName,
+				Namespaced: true,
+			},
+			item.GetNamespace(),
+		)
+		_, err = resClient.Create(item)
+		if err != nil {
+			return errors.Wrap(err, "restoring tprdata")
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) deleteTPRData(tprKind, tprName string) error {
+	nsList, err := m.nsClient.List(metav1.ListOptions{})
+	if err != nil {
+		return errors.Wrap(err, "listing namspaces")
+	}
+
+	for _, ns := range nsList.Items {
+		resClient := m.dynClient.Resource(
+			&metav1.APIResource{
+				Kind:       tprKind,
+				Name:       tprName,
+				Namespaced: true,
+			},
+			ns.ObjectMeta.Name,
+		)
+
+		err := resClient.DeleteCollection(&metav1.DeleteOptions{}, metav1.ListOptions{})
+		if err != nil {
+			return errors.Wrapf(err, "deleting tprdata in namespace \"%s\"", ns.ObjectMeta.Name)
+		}
+	}
+
+	return nil
+}

pkg/prometheus/operator.go

@@ -29,6 +29,8 @@ import (
 	"github.com/go-kit/kit/log"
 	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
+	extensionsobj "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -39,15 +41,16 @@ import (
 	"k8s.io/client-go/pkg/api"
 	"k8s.io/client-go/pkg/api/v1"
 	"k8s.io/client-go/pkg/apis/apps/v1beta1"
-	extensionsobj "k8s.io/client-go/pkg/apis/extensions/v1beta1"
+	extensionsobjold "k8s.io/client-go/pkg/apis/extensions/v1beta1"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/cache"
 )
 
 const (
-	tprServiceMonitor = "service-monitor." + v1alpha1.TPRGroup
-	tprPrometheus     = "prometheus." + v1alpha1.TPRGroup
-	configFilename    = "prometheus.yaml"
+	configFilename = "prometheus.yaml"
+
+	crdServiceMonitor = v1alpha1.ServiceMonitorName + "." + v1alpha1.Group
+	crdPrometheus     = v1alpha1.PrometheusName + "." + v1alpha1.Group
 
 	resyncPeriod = 5 * time.Minute
 )
@@ -55,9 +58,10 @@ const (
 // Operator manages lify cycle of Prometheus deployments and
 // monitoring configurations.
 type Operator struct {
-	kclient *kubernetes.Clientset
-	mclient *v1alpha1.MonitoringV1alpha1Client
-	logger  log.Logger
+	kclient   *kubernetes.Clientset
+	mclient   *v1alpha1.MonitoringV1alpha1Client
+	crdclient apiextensionsclient.Interface
+	logger    log.Logger
 
 	promInf cache.SharedIndexInformer
 	smonInf cache.SharedIndexInformer
@@ -108,6 +112,11 @@ func New(conf Config, logger log.Logger) (*Operator, error) {
 		return nil, err
 	}
 
+	crdclient, err := apiextensionsclient.NewForConfig(cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "instantiating apiextensions client failed")
+	}
+
 	kubeletObjectName := ""
 	kubeletObjectNamespace := ""
 	kubeletSyncEnabled := false
@@ -125,6 +134,7 @@ func New(conf Config, logger log.Logger) (*Operator, error) {
 	c := &Operator{
 		kclient:                client,
 		mclient:                mclient,
+		crdclient:              crdclient,
 		logger:                 logger,
 		queue:                  workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "prometheus"),
 		host:                   cfg.Host,
@@ -221,8 +231,19 @@ func (c *Operator) Run(stopc <-chan struct{}) error {
 		}
 		c.logger.Log("msg", "connection established", "cluster-version", v)
 
-		if err := c.createTPRs(); err != nil {
-			errChan <- errors.Wrap(err, "creating TPRs failed")
+		mv, err := k8sutil.GetMinorVersion(c.kclient.Discovery())
+		if mv < 7 {
+			if err := c.createTPRs(); err != nil {
+				errChan <- errors.Wrap(err, "creating TPRs failed")
+				return
+			}
+
+			errChan <- nil
+			return
+		}
+
+		if err := c.createCRDs(); err != nil {
+			errChan <- errors.Wrap(err, "creating CRDs failed")
 			return
 		}
 		errChan <- nil
@@ -233,7 +254,7 @@ func (c *Operator) Run(stopc <-chan struct{}) error {
 		if err != nil {
 			return err
 		}
-		c.logger.Log("msg", "TPR API endpoints ready")
+		c.logger.Log("msg", "CRD API endpoints ready")
 	case <-stopc:
 		return nil
 	}
@@ -794,7 +815,7 @@ func PrometheusStatus(kclient kubernetes.Interface, p *v1alpha1.Prometheus) (*v1
 }
 
 // needsUpdate checks whether the given pod conforms with the pod template spec
-// for various attributes that are influenced by the Prometheus TPR settings.
+// for various attributes that are influenced by the Prometheus CRD settings.
 func needsUpdate(pod *v1.Pod, tmpl v1.PodTemplateSpec) bool {
 	c1 := pod.Spec.Containers[0]
 	c2 := tmpl.Spec.Containers[0]
@@ -1011,22 +1032,22 @@ func (c *Operator) selectServiceMonitors(p *v1alpha1.Prometheus) (map[string]*v1
 }
 
 func (c *Operator) createTPRs() error {
-	tprs := []*extensionsobj.ThirdPartyResource{
+	tprs := []*extensionsobjold.ThirdPartyResource{
 		{
 			ObjectMeta: metav1.ObjectMeta{
-				Name: tprServiceMonitor,
+				Name: "service-monitor." + v1alpha1.Group,
 			},
-			Versions: []extensionsobj.APIVersion{
-				{Name: v1alpha1.TPRVersion},
+			Versions: []extensionsobjold.APIVersion{
+				{Name: v1alpha1.Version},
 			},
 			Description: "Prometheus monitoring for a service",
 		},
 		{
 			ObjectMeta: metav1.ObjectMeta{
-				Name: tprPrometheus,
+				Name: "prometheus." + v1alpha1.Group,
 			},
-			Versions: []extensionsobj.APIVersion{
-				{Name: v1alpha1.TPRVersion},
+			Versions: []extensionsobjold.APIVersion{
+				{Name: v1alpha1.Version},
 			},
 			Description: "Managed Prometheus server",
 		},
@@ -1041,9 +1062,59 @@ func (c *Operator) createTPRs() error {
 	}
 
 	// We have to wait for the TPRs to be ready. Otherwise the initial watch may fail.
-	err := k8sutil.WaitForTPRReady(c.kclient.CoreV1().RESTClient(), v1alpha1.TPRGroup, v1alpha1.TPRVersion, v1alpha1.TPRPrometheusName)
+	err := k8sutil.WaitForCRDReady(c.kclient.CoreV1().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.PrometheusName)
 	if err != nil {
 		return err
 	}
-	return k8sutil.WaitForTPRReady(c.kclient.CoreV1().RESTClient(), v1alpha1.TPRGroup, v1alpha1.TPRVersion, v1alpha1.TPRServiceMonitorName)
+	return k8sutil.WaitForCRDReady(c.kclient.CoreV1().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.ServiceMonitorName)
+}
+
+func (c *Operator) createCRDs() error {
+	crds := []*extensionsobj.CustomResourceDefinition{
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: crdServiceMonitor,
+			},
+			Spec: extensionsobj.CustomResourceDefinitionSpec{
+				Group:   v1alpha1.Group,
+				Version: v1alpha1.Version,
+				Scope:   extensionsobj.NamespaceScoped,
+				Names: extensionsobj.CustomResourceDefinitionNames{
+					Plural: v1alpha1.ServiceMonitorName,
+					Kind:   v1alpha1.ServiceMonitorsKind,
+				},
+			},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: crdPrometheus,
+			},
+			Spec: extensionsobj.CustomResourceDefinitionSpec{
+				Group:   v1alpha1.Group,
+				Version: v1alpha1.Version,
+				Scope:   extensionsobj.NamespaceScoped,
+				Names: extensionsobj.CustomResourceDefinitionNames{
+					Plural:     v1alpha1.PrometheusName,
+					Kind:       v1alpha1.PrometheusesKind,
+					ShortNames: []string{v1alpha1.PrometheusShort},
+				},
+			},
+		},
+	}
+
+	crdClient := c.crdclient.ApiextensionsV1beta1().CustomResourceDefinitions()
+
+	for _, crd := range crds {
+		if _, err := crdClient.Create(crd); err != nil && !apierrors.IsAlreadyExists(err) {
+			return errors.Wrapf(err, "creating CRD: %s", crd.Spec.Names.Kind)
+		}
+		c.logger.Log("msg", "CRD created", "crd", crd.Spec.Names.Kind)
+	}
+
+	// We have to wait for the CRDs to be ready. Otherwise the initial watch may fail.
+	err := k8sutil.WaitForCRDReady(c.kclient.CoreV1().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.PrometheusName)
+	if err != nil {
+		return err
+	}
+	return k8sutil.WaitForCRDReady(c.kclient.CoreV1().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.ServiceMonitorName)
 }

test/e2e/alertmanager_test.go

@@ -27,7 +27,7 @@ import (
 	"k8s.io/client-go/pkg/api/v1"
 	"k8s.io/client-go/pkg/apis/extensions/v1beta1"
 
-	testFramework "github.com/coreos/prometheus-operator/test/e2e/framework"
+	testFramework "github.com/coreos/prometheus-operator/test/framework"
 )
 
 func TestAlertmanagerCreateDeleteCluster(t *testing.T) {

test/e2e/main_test.go

@@ -20,7 +20,7 @@ import (
 	"os"
 	"testing"
 
-	operatorFramework "github.com/coreos/prometheus-operator/test/e2e/framework"
+	operatorFramework "github.com/coreos/prometheus-operator/test/framework"
 )
 
 var framework *operatorFramework.Framework

test/e2e/prometheus_test.go

@@ -33,7 +33,7 @@ import (
 	"github.com/coreos/prometheus-operator/pkg/alertmanager"
 	"github.com/coreos/prometheus-operator/pkg/client/monitoring/v1alpha1"
 	"github.com/coreos/prometheus-operator/pkg/prometheus"
-	testFramework "github.com/coreos/prometheus-operator/test/e2e/framework"
+	testFramework "github.com/coreos/prometheus-operator/test/framework"
 	"github.com/pkg/errors"
 )
 

test/framework/deployment.go

@@ -16,8 +16,12 @@ package framework
 
 import (
 	"fmt"
+	"time"
+
 	"github.com/pkg/errors"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/apimachinery/pkg/util/yaml"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/pkg/apis/extensions/v1beta1"
@@ -59,3 +63,21 @@ func DeleteDeployment(kubeClient kubernetes.Interface, namespace, name string) e
 	}
 	return kubeClient.Extensions().Deployments(namespace).Delete(d.Name, &metav1.DeleteOptions{})
 }
+
+func WaitUntilDeploymentGone(kubeClient kubernetes.Interface, namespace, name string, timeout time.Duration) error {
+	return wait.Poll(time.Second, timeout, func() (bool, error) {
+		_, err := kubeClient.
+			AppsV1beta1().Deployments(namespace).
+			Get(name, metav1.GetOptions{})
+
+		if err != nil {
+			if apierrors.IsNotFound(err) {
+				return true, nil
+			}
+
+			return false, err
+		}
+
+		return false, nil
+	})
+}

test/framework/framework.go

@@ -19,6 +19,7 @@ import (
 	"testing"
 	"time"
 
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/client-go/kubernetes"
@@ -77,7 +78,7 @@ func New(ns, kubeconfig, opImage string) (*Framework, error) {
 		DefaultTimeout: time.Minute,
 	}
 
-	err = f.setup(opImage)
+	err = f.Setup(opImage)
 	if err != nil {
 		return nil, errors.Wrap(err, "setup test environment failed")
 	}
@@ -85,7 +86,7 @@ func New(ns, kubeconfig, opImage string) (*Framework, error) {
 	return f, nil
 }
 
-func (f *Framework) setup(opImage string) error {
+func (f *Framework) Setup(opImage string) error {
 	if err := f.setupPrometheusOperator(opImage); err != nil {
 		return errors.Wrap(err, "setup prometheus operator failed")
 	}
@@ -93,19 +94,19 @@ func (f *Framework) setup(opImage string) error {
 }
 
 func (f *Framework) setupPrometheusOperator(opImage string) error {
-	if _, err := CreateServiceAccount(f.KubeClient, f.Namespace.Name, "../../example/rbac/prometheus-operator/prometheus-operator-service-account.yaml"); err != nil {
+	if _, err := CreateServiceAccount(f.KubeClient, f.Namespace.Name, "../../example/rbac/prometheus-operator/prometheus-operator-service-account.yaml"); err != nil && !apierrors.IsAlreadyExists(err) {
 		return errors.Wrap(err, "failed to create prometheus operator service account")
 	}
 
-	if err := CreateClusterRole(f.KubeClient, "../../example/rbac/prometheus-operator/prometheus-operator-cluster-role.yaml"); err != nil {
+	if err := CreateClusterRole(f.KubeClient, "../../example/rbac/prometheus-operator/prometheus-operator-cluster-role.yaml"); err != nil && !apierrors.IsAlreadyExists(err) {
 		return errors.Wrap(err, "failed to create prometheus cluster role")
 	}
 
-	if _, err := CreateClusterRoleBinding(f.KubeClient, f.Namespace.Name, "../../example/rbac/prometheus-operator/prometheus-operator-cluster-role-binding.yaml"); err != nil {
+	if _, err := CreateClusterRoleBinding(f.KubeClient, f.Namespace.Name, "../../example/rbac/prometheus-operator/prometheus-operator-cluster-role-binding.yaml"); err != nil && !apierrors.IsAlreadyExists(err) {
 		return errors.Wrap(err, "failed to create prometheus cluster role binding")
 	}
 
-	if err := CreateClusterRole(f.KubeClient, "../../example/rbac/prometheus/prometheus-cluster-role.yaml"); err != nil {
+	if err := CreateClusterRole(f.KubeClient, "../../example/rbac/prometheus/prometheus-cluster-role.yaml"); err != nil && !apierrors.IsAlreadyExists(err) {
 		return errors.Wrap(err, "failed to create prometheus cluster role")
 	}
 
@@ -136,17 +137,17 @@ func (f *Framework) setupPrometheusOperator(opImage string) error {
 	}
 	f.OperatorPod = &pl.Items[0]
 
-	err = k8sutil.WaitForTPRReady(f.KubeClient.Core().RESTClient(), v1alpha1.TPRGroup, v1alpha1.TPRVersion, v1alpha1.TPRPrometheusName)
+	err = k8sutil.WaitForCRDReady(f.KubeClient.Core().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.PrometheusName)
 	if err != nil {
 		return err
 	}
 
-	err = k8sutil.WaitForTPRReady(f.KubeClient.Core().RESTClient(), v1alpha1.TPRGroup, v1alpha1.TPRVersion, v1alpha1.TPRServiceMonitorName)
+	err = k8sutil.WaitForCRDReady(f.KubeClient.Core().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.ServiceMonitorName)
 	if err != nil {
 		return err
 	}
 
-	return k8sutil.WaitForTPRReady(f.KubeClient.Core().RESTClient(), v1alpha1.TPRGroup, v1alpha1.TPRVersion, v1alpha1.TPRAlertmanagerName)
+	return k8sutil.WaitForCRDReady(f.KubeClient.Core().RESTClient(), v1alpha1.Group, v1alpha1.Version, v1alpha1.AlertmanagerName)
 }
 
 func (ctx *TestCtx) SetupPrometheusRBAC(t *testing.T, ns string, kubeClient kubernetes.Interface) {
@@ -156,7 +157,7 @@ func (ctx *TestCtx) SetupPrometheusRBAC(t *testing.T, ns string, kubeClient kube
 		ctx.AddFinalizerFn(finalizerFn)
 	}
 
-	if finalizerFn, err := CreateRoleBinding(kubeClient, ns, "framework/ressources/prometheus-role-binding.yml"); err != nil {
+	if finalizerFn, err := CreateRoleBinding(kubeClient, ns, "../framework/ressources/prometheus-role-binding.yml"); err != nil {
 		t.Fatal(errors.Wrap(err, "failed to create prometheus role binding"))
 	} else {
 		ctx.AddFinalizerFn(finalizerFn)

test/migration/migration_test.go

@@ -0,0 +1,201 @@
+package migration
+
+import (
+	"flag"
+	"log"
+	"os"
+	"reflect"
+	"testing"
+
+	"github.com/coreos/prometheus-operator/pkg/client/monitoring/v1alpha1"
+	"github.com/coreos/prometheus-operator/pkg/k8sutil"
+	operatorFramework "github.com/coreos/prometheus-operator/test/framework"
+	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+var framework *operatorFramework.Framework
+var kubeconfig, opImage, ns, ip *string
+
+func TestMain(m *testing.M) {
+	kubeconfig = flag.String("kubeconfig", "", "kube config path, e.g. $HOME/.kube/config")
+	opImage = flag.String("operator-image", "", "operator image, e.g. quay.io/coreos/prometheus-operator")
+	ns = flag.String("namespace", "prometheus-operator-migration-tests", "migration test namespace")
+	flag.Parse()
+
+	os.Exit(m.Run())
+}
+
+func TestMigration(t *testing.T) {
+	// Create all the clients required.
+	config, err := clientcmd.BuildConfigFromFlags("", *kubeconfig)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	kclient, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	mv, err := k8sutil.GetMinorVersion(kclient.Discovery())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if mv < 7 {
+		t.Skip("lower than 1.7 version")
+		return
+	}
+
+	extClient, err := apiextensionsclient.NewForConfig(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tprClient := kclient.ExtensionsV1beta1().ThirdPartyResources()
+	crdClient := extClient.ApiextensionsV1beta1().CustomResourceDefinitions()
+
+	if framework, err = operatorFramework.New(
+		*ns,
+		*kubeconfig,
+		"quay.io/coreos/prometheus-operator:v0.10.2",
+	); err != nil {
+		log.Printf("failed to setup framework: %v\n", err)
+		t.Fatal(err)
+	}
+
+	ctx := framework.NewTestCtx(t)
+	defer ctx.Cleanup(t)
+	ns2 := ctx.CreateNamespace(t, framework.KubeClient)
+	ctx.SetupPrometheusRBAC(t, ns2, framework.KubeClient)
+
+	// Launch the objects.
+	name := "test"
+	group := "tpr-migration-test"
+
+	prometheusTPR := framework.MakeBasicPrometheus(ns2, name, name, 1)
+	prometheusTPR.Namespace = ns2
+	if err := framework.CreatePrometheusAndWaitUntilReady(ns2, prometheusTPR); err != nil {
+		t.Fatal(err)
+	}
+
+	s := framework.MakeBasicServiceMonitor(group)
+	if _, err := framework.MonClient.ServiceMonitors(ns2).Create(s); err != nil {
+		t.Fatal("Creating ServiceMonitor failed: ", err)
+	}
+
+	if err := framework.CreateAlertmanagerAndWaitUntilReady(ns2, framework.MakeBasicAlertmanager(name, 3)); err != nil {
+		t.Fatal(err)
+	}
+
+	obj, err := framework.MonClient.Prometheuses(ns2).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	proms := obj.(*v1alpha1.PrometheusList)
+
+	// Get the objects.
+	obj, err = framework.MonClient.Alertmanagers(ns2).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ams := obj.(*v1alpha1.AlertmanagerList)
+
+	obj, err = framework.MonClient.ServiceMonitors(ns2).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sms := obj.(*v1alpha1.ServiceMonitorList)
+
+	// Delete and launch new operator.
+	if err := operatorFramework.DeleteDeployment(
+		framework.KubeClient,
+		framework.Namespace.Name,
+		"prometheus-operator",
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := operatorFramework.WaitUntilDeploymentGone(
+		framework.KubeClient,
+		framework.Namespace.Name,
+		"prometheus-operator",
+		framework.DefaultTimeout,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := framework.Setup(*opImage); err != nil {
+		t.Fatal(err)
+	}
+
+	// Check if TPRs are deleted.
+	tprList, err := tprClient.List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(tprList.Items) != 0 {
+		t.Fatalf("expected 0 TPRs got %d", len(tprList.Items))
+	}
+
+	// Check if CRDs are created.
+	crdList, err := crdClient.List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(crdList.Items) != 3 {
+		t.Fatalf("expected 3 CRDs got %d", len(crdList.Items))
+	}
+
+	// Compare old and new objects.
+	obj, err = framework.MonClient.Prometheuses(ns2).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	promsNew := obj.(*v1alpha1.PrometheusList)
+	if len(promsNew.Items) != len(proms.Items) {
+		t.Fatalf("expected %d prometheuses, got %d", len(proms.Items), len(promsNew.Items))
+	}
+
+	for i, prom := range proms.Items {
+		if !reflect.DeepEqual(prom.Spec, promsNew.Items[i].Spec) {
+			t.Fatalf("The prometheus object changed %d", i)
+		}
+	}
+
+	obj, err = framework.MonClient.Alertmanagers(ns2).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	amsNew := obj.(*v1alpha1.AlertmanagerList)
+	if len(amsNew.Items) != len(ams.Items) {
+		t.Fatalf("expected %d ams, got %d", len(ams.Items), len(amsNew.Items))
+	}
+
+	for i, am := range ams.Items {
+		if !reflect.DeepEqual(am.Spec, amsNew.Items[i].Spec) {
+			t.Fatalf("The alertmanager object changed %d", i)
+		}
+	}
+
+	obj, err = framework.MonClient.ServiceMonitors(ns2).List(metav1.ListOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	smsNew := obj.(*v1alpha1.ServiceMonitorList)
+	if len(smsNew.Items) != len(sms.Items) {
+		t.Fatalf("expected %d ams, got %d", len(sms.Items), len(smsNew.Items))
+	}
+
+	for i, sm := range sms.Items {
+		if !reflect.DeepEqual(sm.Spec, smsNew.Items[i].Spec) {
+			t.Fatalf("The servicemonitor object changed %d", i)
+		}
+	}
+
+	if err := framework.Teardown(); err != nil {
+		t.Fatal(err)
+	}
+}

vendor/cloud.google.com/go/LICENSE

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2014 Google Inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/cloud.google.com/go/compute/metadata/metadata.go

@@ -1,438 +0,0 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package metadata provides access to Google Compute Engine (GCE)
-// metadata and API service accounts.
-//
-// This package is a wrapper around the GCE metadata service,
-// as documented at https://developers.google.com/compute/docs/metadata.
-package metadata
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"runtime"
-	"strings"
-	"sync"
-	"time"
-
-	"golang.org/x/net/context"
-	"golang.org/x/net/context/ctxhttp"
-
-	"cloud.google.com/go/internal"
-)
-
-const (
-	// metadataIP is the documented metadata server IP address.
-	metadataIP = "169.254.169.254"
-
-	// metadataHostEnv is the environment variable specifying the
-	// GCE metadata hostname.  If empty, the default value of
-	// metadataIP ("169.254.169.254") is used instead.
-	// This is variable name is not defined by any spec, as far as
-	// I know; it was made up for the Go package.
-	metadataHostEnv = "GCE_METADATA_HOST"
-)
-
-type cachedValue struct {
-	k    string
-	trim bool
-	mu   sync.Mutex
-	v    string
-}
-
-var (
-	projID  = &cachedValue{k: "project/project-id", trim: true}
-	projNum = &cachedValue{k: "project/numeric-project-id", trim: true}
-	instID  = &cachedValue{k: "instance/id", trim: true}
-)
-
-var (
-	metaClient = &http.Client{
-		Transport: &internal.Transport{
-			Base: &http.Transport{
-				Dial: (&net.Dialer{
-					Timeout:   2 * time.Second,
-					KeepAlive: 30 * time.Second,
-				}).Dial,
-				ResponseHeaderTimeout: 2 * time.Second,
-			},
-		},
-	}
-	subscribeClient = &http.Client{
-		Transport: &internal.Transport{
-			Base: &http.Transport{
-				Dial: (&net.Dialer{
-					Timeout:   2 * time.Second,
-					KeepAlive: 30 * time.Second,
-				}).Dial,
-			},
-		},
-	}
-)
-
-// NotDefinedError is returned when requested metadata is not defined.
-//
-// The underlying string is the suffix after "/computeMetadata/v1/".
-//
-// This error is not returned if the value is defined to be the empty
-// string.
-type NotDefinedError string
-
-func (suffix NotDefinedError) Error() string {
-	return fmt.Sprintf("metadata: GCE metadata %q not defined", string(suffix))
-}
-
-// Get returns a value from the metadata service.
-// The suffix is appended to "http://${GCE_METADATA_HOST}/computeMetadata/v1/".
-//
-// If the GCE_METADATA_HOST environment variable is not defined, a default of
-// 169.254.169.254 will be used instead.
-//
-// If the requested metadata is not defined, the returned error will
-// be of type NotDefinedError.
-func Get(suffix string) (string, error) {
-	val, _, err := getETag(metaClient, suffix)
-	return val, err
-}
-
-// getETag returns a value from the metadata service as well as the associated
-// ETag using the provided client. This func is otherwise equivalent to Get.
-func getETag(client *http.Client, suffix string) (value, etag string, err error) {
-	// Using a fixed IP makes it very difficult to spoof the metadata service in
-	// a container, which is an important use-case for local testing of cloud
-	// deployments. To enable spoofing of the metadata service, the environment
-	// variable GCE_METADATA_HOST is first inspected to decide where metadata
-	// requests shall go.
-	host := os.Getenv(metadataHostEnv)
-	if host == "" {
-		// Using 169.254.169.254 instead of "metadata" here because Go
-		// binaries built with the "netgo" tag and without cgo won't
-		// know the search suffix for "metadata" is
-		// ".google.internal", and this IP address is documented as
-		// being stable anyway.
-		host = metadataIP
-	}
-	url := "http://" + host + "/computeMetadata/v1/" + suffix
-	req, _ := http.NewRequest("GET", url, nil)
-	req.Header.Set("Metadata-Flavor", "Google")
-	res, err := client.Do(req)
-	if err != nil {
-		return "", "", err
-	}
-	defer res.Body.Close()
-	if res.StatusCode == http.StatusNotFound {
-		return "", "", NotDefinedError(suffix)
-	}
-	if res.StatusCode != 200 {
-		return "", "", fmt.Errorf("status code %d trying to fetch %s", res.StatusCode, url)
-	}
-	all, err := ioutil.ReadAll(res.Body)
-	if err != nil {
-		return "", "", err
-	}
-	return string(all), res.Header.Get("Etag"), nil
-}
-
-func getTrimmed(suffix string) (s string, err error) {
-	s, err = Get(suffix)
-	s = strings.TrimSpace(s)
-	return
-}
-
-func (c *cachedValue) get() (v string, err error) {
-	defer c.mu.Unlock()
-	c.mu.Lock()
-	if c.v != "" {
-		return c.v, nil
-	}
-	if c.trim {
-		v, err = getTrimmed(c.k)
-	} else {
-		v, err = Get(c.k)
-	}
-	if err == nil {
-		c.v = v
-	}
-	return
-}
-
-var (
-	onGCEOnce sync.Once
-	onGCE     bool
-)
-
-// OnGCE reports whether this process is running on Google Compute Engine.
-func OnGCE() bool {
-	onGCEOnce.Do(initOnGCE)
-	return onGCE
-}
-
-func initOnGCE() {
-	onGCE = testOnGCE()
-}
-
-func testOnGCE() bool {
-	// The user explicitly said they're on GCE, so trust them.
-	if os.Getenv(metadataHostEnv) != "" {
-		return true
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	resc := make(chan bool, 2)
-
-	// Try two strategies in parallel.
-	// See https://github.com/GoogleCloudPlatform/google-cloud-go/issues/194
-	go func() {
-		res, err := ctxhttp.Get(ctx, metaClient, "http://"+metadataIP)
-		if err != nil {
-			resc <- false
-			return
-		}
-		defer res.Body.Close()
-		resc <- res.Header.Get("Metadata-Flavor") == "Google"
-	}()
-
-	go func() {
-		addrs, err := net.LookupHost("metadata.google.internal")
-		if err != nil || len(addrs) == 0 {
-			resc <- false
-			return
-		}
-		resc <- strsContains(addrs, metadataIP)
-	}()
-
-	tryHarder := systemInfoSuggestsGCE()
-	if tryHarder {
-		res := <-resc
-		if res {
-			// The first strategy succeeded, so let's use it.
-			return true
-		}
-		// Wait for either the DNS or metadata server probe to
-		// contradict the other one and say we are running on
-		// GCE. Give it a lot of time to do so, since the system
-		// info already suggests we're running on a GCE BIOS.
-		timer := time.NewTimer(5 * time.Second)
-		defer timer.Stop()
-		select {
-		case res = <-resc:
-			return res
-		case <-timer.C:
-			// Too slow. Who knows what this system is.
-			return false
-		}
-	}
-
-	// There's no hint from the system info that we're running on
-	// GCE, so use the first probe's result as truth, whether it's
-	// true or false. The goal here is to optimize for speed for
-	// users who are NOT running on GCE. We can't assume that
-	// either a DNS lookup or an HTTP request to a blackholed IP
-	// address is fast. Worst case this should return when the
-	// metaClient's Transport.ResponseHeaderTimeout or
-	// Transport.Dial.Timeout fires (in two seconds).
-	return <-resc
-}
-
-// systemInfoSuggestsGCE reports whether the local system (without
-// doing network requests) suggests that we're running on GCE. If this
-// returns true, testOnGCE tries a bit harder to reach its metadata
-// server.
-func systemInfoSuggestsGCE() bool {
-	if runtime.GOOS != "linux" {
-		// We don't have any non-Linux clues available, at least yet.
-		return false
-	}
-	slurp, _ := ioutil.ReadFile("/sys/class/dmi/id/product_name")
-	name := strings.TrimSpace(string(slurp))
-	return name == "Google" || name == "Google Compute Engine"
-}
-
-// Subscribe subscribes to a value from the metadata service.
-// The suffix is appended to "http://${GCE_METADATA_HOST}/computeMetadata/v1/".
-// The suffix may contain query parameters.
-//
-// Subscribe calls fn with the latest metadata value indicated by the provided
-// suffix. If the metadata value is deleted, fn is called with the empty string
-// and ok false. Subscribe blocks until fn returns a non-nil error or the value
-// is deleted. Subscribe returns the error value returned from the last call to
-// fn, which may be nil when ok == false.
-func Subscribe(suffix string, fn func(v string, ok bool) error) error {
-	const failedSubscribeSleep = time.Second * 5
-
-	// First check to see if the metadata value exists at all.
-	val, lastETag, err := getETag(subscribeClient, suffix)
-	if err != nil {
-		return err
-	}
-
-	if err := fn(val, true); err != nil {
-		return err
-	}
-
-	ok := true
-	if strings.ContainsRune(suffix, '?') {
-		suffix += "&wait_for_change=true&last_etag="
-	} else {
-		suffix += "?wait_for_change=true&last_etag="
-	}
-	for {
-		val, etag, err := getETag(subscribeClient, suffix+url.QueryEscape(lastETag))
-		if err != nil {
-			if _, deleted := err.(NotDefinedError); !deleted {
-				time.Sleep(failedSubscribeSleep)
-				continue // Retry on other errors.
-			}
-			ok = false
-		}
-		lastETag = etag
-
-		if err := fn(val, ok); err != nil || !ok {
-			return err
-		}
-	}
-}
-
-// ProjectID returns the current instance's project ID string.
-func ProjectID() (string, error) { return projID.get() }
-
-// NumericProjectID returns the current instance's numeric project ID.
-func NumericProjectID() (string, error) { return projNum.get() }
-
-// InternalIP returns the instance's primary internal IP address.
-func InternalIP() (string, error) {
-	return getTrimmed("instance/network-interfaces/0/ip")
-}
-
-// ExternalIP returns the instance's primary external (public) IP address.
-func ExternalIP() (string, error) {
-	return getTrimmed("instance/network-interfaces/0/access-configs/0/external-ip")
-}
-
-// Hostname returns the instance's hostname. This will be of the form
-// "<instanceID>.c.<projID>.internal".
-func Hostname() (string, error) {
-	return getTrimmed("instance/hostname")
-}
-
-// InstanceTags returns the list of user-defined instance tags,
-// assigned when initially creating a GCE instance.
-func InstanceTags() ([]string, error) {
-	var s []string
-	j, err := Get("instance/tags")
-	if err != nil {
-		return nil, err
-	}
-	if err := json.NewDecoder(strings.NewReader(j)).Decode(&s); err != nil {
-		return nil, err
-	}
-	return s, nil
-}
-
-// InstanceID returns the current VM's numeric instance ID.
-func InstanceID() (string, error) {
-	return instID.get()
-}
-
-// InstanceName returns the current VM's instance ID string.
-func InstanceName() (string, error) {
-	host, err := Hostname()
-	if err != nil {
-		return "", err
-	}
-	return strings.Split(host, ".")[0], nil
-}
-
-// Zone returns the current VM's zone, such as "us-central1-b".
-func Zone() (string, error) {
-	zone, err := getTrimmed("instance/zone")
-	// zone is of the form "projects/<projNum>/zones/<zoneName>".
-	if err != nil {
-		return "", err
-	}
-	return zone[strings.LastIndex(zone, "/")+1:], nil
-}
-
-// InstanceAttributes returns the list of user-defined attributes,
-// assigned when initially creating a GCE VM instance. The value of an
-// attribute can be obtained with InstanceAttributeValue.
-func InstanceAttributes() ([]string, error) { return lines("instance/attributes/") }
-
-// ProjectAttributes returns the list of user-defined attributes
-// applying to the project as a whole, not just this VM.  The value of
-// an attribute can be obtained with ProjectAttributeValue.
-func ProjectAttributes() ([]string, error) { return lines("project/attributes/") }
-
-func lines(suffix string) ([]string, error) {
-	j, err := Get(suffix)
-	if err != nil {
-		return nil, err
-	}
-	s := strings.Split(strings.TrimSpace(j), "\n")
-	for i := range s {
-		s[i] = strings.TrimSpace(s[i])
-	}
-	return s, nil
-}
-
-// InstanceAttributeValue returns the value of the provided VM
-// instance attribute.
-//
-// If the requested attribute is not defined, the returned error will
-// be of type NotDefinedError.
-//
-// InstanceAttributeValue may return ("", nil) if the attribute was
-// defined to be the empty string.
-func InstanceAttributeValue(attr string) (string, error) {
-	return Get("instance/attributes/" + attr)
-}
-
-// ProjectAttributeValue returns the value of the provided
-// project attribute.
-//
-// If the requested attribute is not defined, the returned error will
-// be of type NotDefinedError.
-//
-// ProjectAttributeValue may return ("", nil) if the attribute was
-// defined to be the empty string.
-func ProjectAttributeValue(attr string) (string, error) {
-	return Get("project/attributes/" + attr)
-}
-
-// Scopes returns the service account scopes for the given account.
-// The account may be empty or the string "default" to use the instance's
-// main account.
-func Scopes(serviceAccount string) ([]string, error) {
-	if serviceAccount == "" {
-		serviceAccount = "default"
-	}
-	return lines("instance/service-accounts/" + serviceAccount + "/scopes")
-}
-
-func strsContains(ss []string, s string) bool {
-	for _, v := range ss {
-		if v == s {
-			return true
-		}
-	}
-	return false
-}

vendor/cloud.google.com/go/internal/cloud.go

@@ -1,64 +0,0 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package internal provides support for the cloud packages.
-//
-// Users should not import this package directly.
-package internal
-
-import (
-	"fmt"
-	"net/http"
-)
-
-const userAgent = "gcloud-golang/0.1"
-
-// Transport is an http.RoundTripper that appends Google Cloud client's
-// user-agent to the original request's user-agent header.
-type Transport struct {
-	// TODO(bradfitz): delete internal.Transport. It's too wrappy for what it does.
-	// Do User-Agent some other way.
-
-	// Base is the actual http.RoundTripper
-	// requests will use. It must not be nil.
-	Base http.RoundTripper
-}
-
-// RoundTrip appends a user-agent to the existing user-agent
-// header and delegates the request to the base http.RoundTripper.
-func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
-	req = cloneRequest(req)
-	ua := req.Header.Get("User-Agent")
-	if ua == "" {
-		ua = userAgent
-	} else {
-		ua = fmt.Sprintf("%s %s", ua, userAgent)
-	}
-	req.Header.Set("User-Agent", ua)
-	return t.Base.RoundTrip(req)
-}
-
-// cloneRequest returns a clone of the provided *http.Request.
-// The clone is a shallow copy of the struct and its Header map.
-func cloneRequest(r *http.Request) *http.Request {
-	// shallow copy of the struct
-	r2 := new(http.Request)
-	*r2 = *r
-	// deep copy of the Header
-	r2.Header = make(http.Header)
-	for k, s := range r.Header {
-		r2.Header[k] = s
-	}
-	return r2
-}

vendor/github.com/coreos/go-oidc/LICENSE

@@ -1,202 +0,0 @@
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-

vendor/github.com/coreos/go-oidc/NOTICE

@@ -1,5 +0,0 @@
-CoreOS Project
-Copyright 2014 CoreOS, Inc
-
-This product includes software developed at CoreOS, Inc.
-(http://www.coreos.com/).

vendor/github.com/coreos/go-oidc/http/client.go

@@ -1,7 +0,0 @@
-package http
-
-import "net/http"
-
-type Client interface {
-	Do(*http.Request) (*http.Response, error)
-}

vendor/github.com/coreos/go-oidc/http/http.go

@@ -1,156 +0,0 @@
-package http
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"log"
-	"net/http"
-	"net/url"
-	"path"
-	"strconv"
-	"strings"
-	"time"
-)
-
-func WriteError(w http.ResponseWriter, code int, msg string) {
-	e := struct {
-		Error string `json:"error"`
-	}{
-		Error: msg,
-	}
-	b, err := json.Marshal(e)
-	if err != nil {
-		log.Printf("go-oidc: failed to marshal %#v: %v", e, err)
-		code = http.StatusInternalServerError
-		b = []byte(`{"error":"server_error"}`)
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	w.Write(b)
-}
-
-// BasicAuth parses a username and password from the request's
-// Authorization header. This was pulled from golang master:
-// https://codereview.appspot.com/76540043
-func BasicAuth(r *http.Request) (username, password string, ok bool) {
-	auth := r.Header.Get("Authorization")
-	if auth == "" {
-		return
-	}
-
-	if !strings.HasPrefix(auth, "Basic ") {
-		return
-	}
-	c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(auth, "Basic "))
-	if err != nil {
-		return
-	}
-	cs := string(c)
-	s := strings.IndexByte(cs, ':')
-	if s < 0 {
-		return
-	}
-	return cs[:s], cs[s+1:], true
-}
-
-func cacheControlMaxAge(hdr string) (time.Duration, bool, error) {
-	for _, field := range strings.Split(hdr, ",") {
-		parts := strings.SplitN(strings.TrimSpace(field), "=", 2)
-		k := strings.ToLower(strings.TrimSpace(parts[0]))
-		if k != "max-age" {
-			continue
-		}
-
-		if len(parts) == 1 {
-			return 0, false, errors.New("max-age has no value")
-		}
-
-		v := strings.TrimSpace(parts[1])
-		if v == "" {
-			return 0, false, errors.New("max-age has empty value")
-		}
-
-		age, err := strconv.Atoi(v)
-		if err != nil {
-			return 0, false, err
-		}
-
-		if age <= 0 {
-			return 0, false, nil
-		}
-
-		return time.Duration(age) * time.Second, true, nil
-	}
-
-	return 0, false, nil
-}
-
-func expires(date, expires string) (time.Duration, bool, error) {
-	if date == "" || expires == "" {
-		return 0, false, nil
-	}
-
-	te, err := time.Parse(time.RFC1123, expires)
-	if err != nil {
-		return 0, false, err
-	}
-
-	td, err := time.Parse(time.RFC1123, date)
-	if err != nil {
-		return 0, false, err
-	}
-
-	ttl := te.Sub(td)
-
-	// headers indicate data already expired, caller should not
-	// have to care about this case
-	if ttl <= 0 {
-		return 0, false, nil
-	}
-
-	return ttl, true, nil
-}
-
-func Cacheable(hdr http.Header) (time.Duration, bool, error) {
-	ttl, ok, err := cacheControlMaxAge(hdr.Get("Cache-Control"))
-	if err != nil || ok {
-		return ttl, ok, err
-	}
-
-	return expires(hdr.Get("Date"), hdr.Get("Expires"))
-}
-
-// MergeQuery appends additional query values to an existing URL.
-func MergeQuery(u url.URL, q url.Values) url.URL {
-	uv := u.Query()
-	for k, vs := range q {
-		for _, v := range vs {
-			uv.Add(k, v)
-		}
-	}
-	u.RawQuery = uv.Encode()
-	return u
-}
-
-// NewResourceLocation appends a resource id to the end of the requested URL path.
-func NewResourceLocation(reqURL *url.URL, id string) string {
-	var u url.URL
-	u = *reqURL
-	u.Path = path.Join(u.Path, id)
-	u.RawQuery = ""
-	u.Fragment = ""
-	return u.String()
-}
-
-// CopyRequest returns a clone of the provided *http.Request.
-// The returned object is a shallow copy of the struct and a
-// deep copy of its Header field.
-func CopyRequest(r *http.Request) *http.Request {
-	r2 := *r
-	r2.Header = make(http.Header)
-	for k, s := range r.Header {
-		r2.Header[k] = s
-	}
-	return &r2
-}

vendor/github.com/coreos/go-oidc/http/url.go

@@ -1,29 +0,0 @@
-package http
-
-import (
-	"errors"
-	"net/url"
-)
-
-// ParseNonEmptyURL checks that a string is a parsable URL which is also not empty
-// since `url.Parse("")` does not return an error. Must contian a scheme and a host.
-func ParseNonEmptyURL(u string) (*url.URL, error) {
-	if u == "" {
-		return nil, errors.New("url is empty")
-	}
-
-	ur, err := url.Parse(u)
-	if err != nil {
-		return nil, err
-	}
-
-	if ur.Scheme == "" {
-		return nil, errors.New("url scheme is empty")
-	}
-
-	if ur.Host == "" {
-		return nil, errors.New("url host is empty")
-	}
-
-	return ur, nil
-}

vendor/github.com/coreos/go-oidc/jose/claims.go

@@ -1,126 +0,0 @@
-package jose
-
-import (
-	"encoding/json"
-	"fmt"
-	"math"
-	"time"
-)
-
-type Claims map[string]interface{}
-
-func (c Claims) Add(name string, value interface{}) {
-	c[name] = value
-}
-
-func (c Claims) StringClaim(name string) (string, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return "", false, nil
-	}
-
-	v, ok := cl.(string)
-	if !ok {
-		return "", false, fmt.Errorf("unable to parse claim as string: %v", name)
-	}
-
-	return v, true, nil
-}
-
-func (c Claims) StringsClaim(name string) ([]string, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return nil, false, nil
-	}
-
-	if v, ok := cl.([]string); ok {
-		return v, true, nil
-	}
-
-	// When unmarshaled, []string will become []interface{}.
-	if v, ok := cl.([]interface{}); ok {
-		var ret []string
-		for _, vv := range v {
-			str, ok := vv.(string)
-			if !ok {
-				return nil, false, fmt.Errorf("unable to parse claim as string array: %v", name)
-			}
-			ret = append(ret, str)
-		}
-		return ret, true, nil
-	}
-
-	return nil, false, fmt.Errorf("unable to parse claim as string array: %v", name)
-}
-
-func (c Claims) Int64Claim(name string) (int64, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return 0, false, nil
-	}
-
-	v, ok := cl.(int64)
-	if !ok {
-		vf, ok := cl.(float64)
-		if !ok {
-			return 0, false, fmt.Errorf("unable to parse claim as int64: %v", name)
-		}
-		v = int64(vf)
-	}
-
-	return v, true, nil
-}
-
-func (c Claims) Float64Claim(name string) (float64, bool, error) {
-	cl, ok := c[name]
-	if !ok {
-		return 0, false, nil
-	}
-
-	v, ok := cl.(float64)
-	if !ok {
-		vi, ok := cl.(int64)
-		if !ok {
-			return 0, false, fmt.Errorf("unable to parse claim as float64: %v", name)
-		}
-		v = float64(vi)
-	}
-
-	return v, true, nil
-}
-
-func (c Claims) TimeClaim(name string) (time.Time, bool, error) {
-	v, ok, err := c.Float64Claim(name)
-	if !ok || err != nil {
-		return time.Time{}, ok, err
-	}
-
-	s := math.Trunc(v)
-	ns := (v - s) * math.Pow(10, 9)
-	return time.Unix(int64(s), int64(ns)).UTC(), true, nil
-}
-
-func decodeClaims(payload []byte) (Claims, error) {
-	var c Claims
-	if err := json.Unmarshal(payload, &c); err != nil {
-		return nil, fmt.Errorf("malformed JWT claims, unable to decode: %v", err)
-	}
-	return c, nil
-}
-
-func marshalClaims(c Claims) ([]byte, error) {
-	b, err := json.Marshal(c)
-	if err != nil {
-		return nil, err
-	}
-	return b, nil
-}
-
-func encodeClaims(c Claims) (string, error) {
-	b, err := marshalClaims(c)
-	if err != nil {
-		return "", err
-	}
-
-	return encodeSegment(b), nil
-}

vendor/github.com/coreos/go-oidc/jose/jose.go

@@ -1,112 +0,0 @@
-package jose
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"strings"
-)
-
-const (
-	HeaderMediaType    = "typ"
-	HeaderKeyAlgorithm = "alg"
-	HeaderKeyID        = "kid"
-)
-
-const (
-	// Encryption Algorithm Header Parameter Values for JWS
-	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#page-6
-	AlgHS256 = "HS256"
-	AlgHS384 = "HS384"
-	AlgHS512 = "HS512"
-	AlgRS256 = "RS256"
-	AlgRS384 = "RS384"
-	AlgRS512 = "RS512"
-	AlgES256 = "ES256"
-	AlgES384 = "ES384"
-	AlgES512 = "ES512"
-	AlgPS256 = "PS256"
-	AlgPS384 = "PS384"
-	AlgPS512 = "PS512"
-	AlgNone  = "none"
-)
-
-const (
-	// Algorithm Header Parameter Values for JWE
-	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#section-4.1
-	AlgRSA15            = "RSA1_5"
-	AlgRSAOAEP          = "RSA-OAEP"
-	AlgRSAOAEP256       = "RSA-OAEP-256"
-	AlgA128KW           = "A128KW"
-	AlgA192KW           = "A192KW"
-	AlgA256KW           = "A256KW"
-	AlgDir              = "dir"
-	AlgECDHES           = "ECDH-ES"
-	AlgECDHESA128KW     = "ECDH-ES+A128KW"
-	AlgECDHESA192KW     = "ECDH-ES+A192KW"
-	AlgECDHESA256KW     = "ECDH-ES+A256KW"
-	AlgA128GCMKW        = "A128GCMKW"
-	AlgA192GCMKW        = "A192GCMKW"
-	AlgA256GCMKW        = "A256GCMKW"
-	AlgPBES2HS256A128KW = "PBES2-HS256+A128KW"
-	AlgPBES2HS384A192KW = "PBES2-HS384+A192KW"
-	AlgPBES2HS512A256KW = "PBES2-HS512+A256KW"
-)
-
-const (
-	// Encryption Algorithm Header Parameter Values for JWE
-	// See: https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40#page-22
-	EncA128CBCHS256 = "A128CBC-HS256"
-	EncA128CBCHS384 = "A128CBC-HS384"
-	EncA256CBCHS512 = "A256CBC-HS512"
-	EncA128GCM      = "A128GCM"
-	EncA192GCM      = "A192GCM"
-	EncA256GCM      = "A256GCM"
-)
-
-type JOSEHeader map[string]string
-
-func (j JOSEHeader) Validate() error {
-	if _, exists := j[HeaderKeyAlgorithm]; !exists {
-		return fmt.Errorf("header missing %q parameter", HeaderKeyAlgorithm)
-	}
-
-	return nil
-}
-
-func decodeHeader(seg string) (JOSEHeader, error) {
-	b, err := decodeSegment(seg)
-	if err != nil {
-		return nil, err
-	}
-
-	var h JOSEHeader
-	err = json.Unmarshal(b, &h)
-	if err != nil {
-		return nil, err
-	}
-
-	return h, nil
-}
-
-func encodeHeader(h JOSEHeader) (string, error) {
-	b, err := json.Marshal(h)
-	if err != nil {
-		return "", err
-	}
-
-	return encodeSegment(b), nil
-}
-
-// Decode JWT specific base64url encoding with padding stripped
-func decodeSegment(seg string) ([]byte, error) {
-	if l := len(seg) % 4; l != 0 {
-		seg += strings.Repeat("=", 4-l)
-	}
-	return base64.URLEncoding.DecodeString(seg)
-}
-
-// Encode JWT specific base64url encoding with padding stripped
-func encodeSegment(seg []byte) string {
-	return strings.TrimRight(base64.URLEncoding.EncodeToString(seg), "=")
-}

vendor/github.com/coreos/go-oidc/jose/jwk.go

@@ -1,135 +0,0 @@
-package jose
-
-import (
-	"bytes"
-	"encoding/base64"
-	"encoding/binary"
-	"encoding/json"
-	"math/big"
-	"strings"
-)
-
-// JSON Web Key
-// https://tools.ietf.org/html/draft-ietf-jose-json-web-key-36#page-5
-type JWK struct {
-	ID       string
-	Type     string
-	Alg      string
-	Use      string
-	Exponent int
-	Modulus  *big.Int
-	Secret   []byte
-}
-
-type jwkJSON struct {
-	ID       string `json:"kid"`
-	Type     string `json:"kty"`
-	Alg      string `json:"alg"`
-	Use      string `json:"use"`
-	Exponent string `json:"e"`
-	Modulus  string `json:"n"`
-}
-
-func (j *JWK) MarshalJSON() ([]byte, error) {
-	t := jwkJSON{
-		ID:       j.ID,
-		Type:     j.Type,
-		Alg:      j.Alg,
-		Use:      j.Use,
-		Exponent: encodeExponent(j.Exponent),
-		Modulus:  encodeModulus(j.Modulus),
-	}
-
-	return json.Marshal(&t)
-}
-
-func (j *JWK) UnmarshalJSON(data []byte) error {
-	var t jwkJSON
-	err := json.Unmarshal(data, &t)
-	if err != nil {
-		return err
-	}
-
-	e, err := decodeExponent(t.Exponent)
-	if err != nil {
-		return err
-	}
-
-	n, err := decodeModulus(t.Modulus)
-	if err != nil {
-		return err
-	}
-
-	j.ID = t.ID
-	j.Type = t.Type
-	j.Alg = t.Alg
-	j.Use = t.Use
-	j.Exponent = e
-	j.Modulus = n
-
-	return nil
-}
-
-type JWKSet struct {
-	Keys []JWK `json:"keys"`
-}
-
-func decodeExponent(e string) (int, error) {
-	decE, err := decodeBase64URLPaddingOptional(e)
-	if err != nil {
-		return 0, err
-	}
-	var eBytes []byte
-	if len(decE) < 8 {
-		eBytes = make([]byte, 8-len(decE), 8)
-		eBytes = append(eBytes, decE...)
-	} else {
-		eBytes = decE
-	}
-	eReader := bytes.NewReader(eBytes)
-	var E uint64
-	err = binary.Read(eReader, binary.BigEndian, &E)
-	if err != nil {
-		return 0, err
-	}
-	return int(E), nil
-}
-
-func encodeExponent(e int) string {
-	b := make([]byte, 8)
-	binary.BigEndian.PutUint64(b, uint64(e))
-	var idx int
-	for ; idx < 8; idx++ {
-		if b[idx] != 0x0 {
-			break
-		}
-	}
-	return base64.URLEncoding.EncodeToString(b[idx:])
-}
-
-// Turns a URL encoded modulus of a key into a big int.
-func decodeModulus(n string) (*big.Int, error) {
-	decN, err := decodeBase64URLPaddingOptional(n)
-	if err != nil {
-		return nil, err
-	}
-	N := big.NewInt(0)
-	N.SetBytes(decN)
-	return N, nil
-}
-
-func encodeModulus(n *big.Int) string {
-	return base64.URLEncoding.EncodeToString(n.Bytes())
-}
-
-// decodeBase64URLPaddingOptional decodes Base64 whether there is padding or not.
-// The stdlib version currently doesn't handle this.
-// We can get rid of this is if this bug:
-//   https://github.com/golang/go/issues/4237
-// ever closes.
-func decodeBase64URLPaddingOptional(e string) ([]byte, error) {
-	if m := len(e) % 4; m != 0 {
-		e += strings.Repeat("=", 4-m)
-	}
-	return base64.URLEncoding.DecodeString(e)
-}

vendor/github.com/coreos/go-oidc/jose/jws.go

@@ -1,51 +0,0 @@
-package jose
-
-import (
-	"fmt"
-	"strings"
-)
-
-type JWS struct {
-	RawHeader  string
-	Header     JOSEHeader
-	RawPayload string
-	Payload    []byte
-	Signature  []byte
-}
-
-// Given a raw encoded JWS token parses it and verifies the structure.
-func ParseJWS(raw string) (JWS, error) {
-	parts := strings.Split(raw, ".")
-	if len(parts) != 3 {
-		return JWS{}, fmt.Errorf("malformed JWS, only %d segments", len(parts))
-	}
-
-	rawSig := parts[2]
-	jws := JWS{
-		RawHeader:  parts[0],
-		RawPayload: parts[1],
-	}
-
-	header, err := decodeHeader(jws.RawHeader)
-	if err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, unable to decode header, %s", err)
-	}
-	if err = header.Validate(); err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, %s", err)
-	}
-	jws.Header = header
-
-	payload, err := decodeSegment(jws.RawPayload)
-	if err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, unable to decode payload: %s", err)
-	}
-	jws.Payload = payload
-
-	sig, err := decodeSegment(rawSig)
-	if err != nil {
-		return JWS{}, fmt.Errorf("malformed JWS, unable to decode signature: %s", err)
-	}
-	jws.Signature = sig
-
-	return jws, nil
-}

vendor/github.com/coreos/go-oidc/jose/jwt.go

@@ -1,82 +0,0 @@
-package jose
-
-import "strings"
-
-type JWT JWS
-
-func ParseJWT(token string) (jwt JWT, err error) {
-	jws, err := ParseJWS(token)
-	if err != nil {
-		return
-	}
-
-	return JWT(jws), nil
-}
-
-func NewJWT(header JOSEHeader, claims Claims) (jwt JWT, err error) {
-	jwt = JWT{}
-
-	jwt.Header = header
-	jwt.Header[HeaderMediaType] = "JWT"
-
-	claimBytes, err := marshalClaims(claims)
-	if err != nil {
-		return
-	}
-	jwt.Payload = claimBytes
-
-	eh, err := encodeHeader(header)
-	if err != nil {
-		return
-	}
-	jwt.RawHeader = eh
-
-	ec, err := encodeClaims(claims)
-	if err != nil {
-		return
-	}
-	jwt.RawPayload = ec
-
-	return
-}
-
-func (j *JWT) KeyID() (string, bool) {
-	kID, ok := j.Header[HeaderKeyID]
-	return kID, ok
-}
-
-func (j *JWT) Claims() (Claims, error) {
-	return decodeClaims(j.Payload)
-}
-
-// Encoded data part of the token which may be signed.
-func (j *JWT) Data() string {
-	return strings.Join([]string{j.RawHeader, j.RawPayload}, ".")
-}
-
-// Full encoded JWT token string in format: header.claims.signature
-func (j *JWT) Encode() string {
-	d := j.Data()
-	s := encodeSegment(j.Signature)
-	return strings.Join([]string{d, s}, ".")
-}
-
-func NewSignedJWT(claims Claims, s Signer) (*JWT, error) {
-	header := JOSEHeader{
-		HeaderKeyAlgorithm: s.Alg(),
-		HeaderKeyID:        s.ID(),
-	}
-
-	jwt, err := NewJWT(header, claims)
-	if err != nil {
-		return nil, err
-	}
-
-	sig, err := s.Sign([]byte(jwt.Data()))
-	if err != nil {
-		return nil, err
-	}
-	jwt.Signature = sig
-
-	return &jwt, nil
-}

vendor/github.com/coreos/go-oidc/jose/sig.go

@@ -1,24 +0,0 @@
-package jose
-
-import (
-	"fmt"
-)
-
-type Verifier interface {
-	ID() string
-	Alg() string
-	Verify(sig []byte, data []byte) error
-}
-
-type Signer interface {
-	Verifier
-	Sign(data []byte) (sig []byte, err error)
-}
-
-func NewVerifier(jwk JWK) (Verifier, error) {
-	if jwk.Type != "RSA" {
-		return nil, fmt.Errorf("unsupported key type %q", jwk.Type)
-	}
-
-	return NewVerifierRSA(jwk)
-}

vendor/github.com/coreos/go-oidc/jose/sig_hmac.go

@@ -1,67 +0,0 @@
-package jose
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/hmac"
-	_ "crypto/sha256"
-	"errors"
-	"fmt"
-)
-
-type VerifierHMAC struct {
-	KeyID  string
-	Hash   crypto.Hash
-	Secret []byte
-}
-
-type SignerHMAC struct {
-	VerifierHMAC
-}
-
-func NewVerifierHMAC(jwk JWK) (*VerifierHMAC, error) {
-	if jwk.Alg != "" && jwk.Alg != "HS256" {
-		return nil, fmt.Errorf("unsupported key algorithm %q", jwk.Alg)
-	}
-
-	v := VerifierHMAC{
-		KeyID:  jwk.ID,
-		Secret: jwk.Secret,
-		Hash:   crypto.SHA256,
-	}
-
-	return &v, nil
-}
-
-func (v *VerifierHMAC) ID() string {
-	return v.KeyID
-}
-
-func (v *VerifierHMAC) Alg() string {
-	return "HS256"
-}
-
-func (v *VerifierHMAC) Verify(sig []byte, data []byte) error {
-	h := hmac.New(v.Hash.New, v.Secret)
-	h.Write(data)
-	if !bytes.Equal(sig, h.Sum(nil)) {
-		return errors.New("invalid hmac signature")
-	}
-	return nil
-}
-
-func NewSignerHMAC(kid string, secret []byte) *SignerHMAC {
-	return &SignerHMAC{
-		VerifierHMAC: VerifierHMAC{
-			KeyID:  kid,
-			Secret: secret,
-			Hash:   crypto.SHA256,
-		},
-	}
-}
-
-func (s *SignerHMAC) Sign(data []byte) ([]byte, error) {
-	h := hmac.New(s.Hash.New, s.Secret)
-	h.Write(data)
-	return h.Sum(nil), nil
-}

vendor/github.com/coreos/go-oidc/jose/sig_rsa.go

@@ -1,67 +0,0 @@
-package jose
-
-import (
-	"crypto"
-	"crypto/rand"
-	"crypto/rsa"
-	"fmt"
-)
-
-type VerifierRSA struct {
-	KeyID     string
-	Hash      crypto.Hash
-	PublicKey rsa.PublicKey
-}
-
-type SignerRSA struct {
-	PrivateKey rsa.PrivateKey
-	VerifierRSA
-}
-
-func NewVerifierRSA(jwk JWK) (*VerifierRSA, error) {
-	if jwk.Alg != "" && jwk.Alg != "RS256" {
-		return nil, fmt.Errorf("unsupported key algorithm %q", jwk.Alg)
-	}
-
-	v := VerifierRSA{
-		KeyID: jwk.ID,
-		PublicKey: rsa.PublicKey{
-			N: jwk.Modulus,
-			E: jwk.Exponent,
-		},
-		Hash: crypto.SHA256,
-	}
-
-	return &v, nil
-}
-
-func NewSignerRSA(kid string, key rsa.PrivateKey) *SignerRSA {
-	return &SignerRSA{
-		PrivateKey: key,
-		VerifierRSA: VerifierRSA{
-			KeyID:     kid,
-			PublicKey: key.PublicKey,
-			Hash:      crypto.SHA256,
-		},
-	}
-}
-
-func (v *VerifierRSA) ID() string {
-	return v.KeyID
-}
-
-func (v *VerifierRSA) Alg() string {
-	return "RS256"
-}
-
-func (v *VerifierRSA) Verify(sig []byte, data []byte) error {
-	h := v.Hash.New()
-	h.Write(data)
-	return rsa.VerifyPKCS1v15(&v.PublicKey, v.Hash, h.Sum(nil), sig)
-}
-
-func (s *SignerRSA) Sign(data []byte) ([]byte, error) {
-	h := s.Hash.New()
-	h.Write(data)
-	return rsa.SignPKCS1v15(rand.Reader, &s.PrivateKey, s.Hash, h.Sum(nil))
-}

vendor/github.com/coreos/go-oidc/key/key.go

@@ -1,153 +0,0 @@
-package key
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"encoding/hex"
-	"encoding/json"
-	"io"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-func NewPublicKey(jwk jose.JWK) *PublicKey {
-	return &PublicKey{jwk: jwk}
-}
-
-type PublicKey struct {
-	jwk jose.JWK
-}
-
-func (k *PublicKey) MarshalJSON() ([]byte, error) {
-	return json.Marshal(&k.jwk)
-}
-
-func (k *PublicKey) UnmarshalJSON(data []byte) error {
-	var jwk jose.JWK
-	if err := json.Unmarshal(data, &jwk); err != nil {
-		return err
-	}
-	k.jwk = jwk
-	return nil
-}
-
-func (k *PublicKey) ID() string {
-	return k.jwk.ID
-}
-
-func (k *PublicKey) Verifier() (jose.Verifier, error) {
-	return jose.NewVerifierRSA(k.jwk)
-}
-
-type PrivateKey struct {
-	KeyID      string
-	PrivateKey *rsa.PrivateKey
-}
-
-func (k *PrivateKey) ID() string {
-	return k.KeyID
-}
-
-func (k *PrivateKey) Signer() jose.Signer {
-	return jose.NewSignerRSA(k.ID(), *k.PrivateKey)
-}
-
-func (k *PrivateKey) JWK() jose.JWK {
-	return jose.JWK{
-		ID:       k.KeyID,
-		Type:     "RSA",
-		Alg:      "RS256",
-		Use:      "sig",
-		Exponent: k.PrivateKey.PublicKey.E,
-		Modulus:  k.PrivateKey.PublicKey.N,
-	}
-}
-
-type KeySet interface {
-	ExpiresAt() time.Time
-}
-
-type PublicKeySet struct {
-	keys      []PublicKey
-	index     map[string]*PublicKey
-	expiresAt time.Time
-}
-
-func NewPublicKeySet(jwks []jose.JWK, exp time.Time) *PublicKeySet {
-	keys := make([]PublicKey, len(jwks))
-	index := make(map[string]*PublicKey)
-	for i, jwk := range jwks {
-		keys[i] = *NewPublicKey(jwk)
-		index[keys[i].ID()] = &keys[i]
-	}
-	return &PublicKeySet{
-		keys:      keys,
-		index:     index,
-		expiresAt: exp,
-	}
-}
-
-func (s *PublicKeySet) ExpiresAt() time.Time {
-	return s.expiresAt
-}
-
-func (s *PublicKeySet) Keys() []PublicKey {
-	return s.keys
-}
-
-func (s *PublicKeySet) Key(id string) *PublicKey {
-	return s.index[id]
-}
-
-type PrivateKeySet struct {
-	keys        []*PrivateKey
-	ActiveKeyID string
-	expiresAt   time.Time
-}
-
-func NewPrivateKeySet(keys []*PrivateKey, exp time.Time) *PrivateKeySet {
-	return &PrivateKeySet{
-		keys:        keys,
-		ActiveKeyID: keys[0].ID(),
-		expiresAt:   exp.UTC(),
-	}
-}
-
-func (s *PrivateKeySet) Keys() []*PrivateKey {
-	return s.keys
-}
-
-func (s *PrivateKeySet) ExpiresAt() time.Time {
-	return s.expiresAt
-}
-
-func (s *PrivateKeySet) Active() *PrivateKey {
-	for i, k := range s.keys {
-		if k.ID() == s.ActiveKeyID {
-			return s.keys[i]
-		}
-	}
-
-	return nil
-}
-
-type GeneratePrivateKeyFunc func() (*PrivateKey, error)
-
-func GeneratePrivateKey() (*PrivateKey, error) {
-	pk, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return nil, err
-	}
-	keyID := make([]byte, 20)
-	if _, err := io.ReadFull(rand.Reader, keyID); err != nil {
-		return nil, err
-	}
-
-	k := PrivateKey{
-		KeyID:      hex.EncodeToString(keyID),
-		PrivateKey: pk,
-	}
-
-	return &k, nil
-}

vendor/github.com/coreos/go-oidc/key/manager.go

@@ -1,99 +0,0 @@
-package key
-
-import (
-	"errors"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/pkg/health"
-)
-
-type PrivateKeyManager interface {
-	ExpiresAt() time.Time
-	Signer() (jose.Signer, error)
-	JWKs() ([]jose.JWK, error)
-	PublicKeys() ([]PublicKey, error)
-
-	WritableKeySetRepo
-	health.Checkable
-}
-
-func NewPrivateKeyManager() PrivateKeyManager {
-	return &privateKeyManager{
-		clock: clockwork.NewRealClock(),
-	}
-}
-
-type privateKeyManager struct {
-	keySet *PrivateKeySet
-	clock  clockwork.Clock
-}
-
-func (m *privateKeyManager) ExpiresAt() time.Time {
-	if m.keySet == nil {
-		return m.clock.Now().UTC()
-	}
-
-	return m.keySet.ExpiresAt()
-}
-
-func (m *privateKeyManager) Signer() (jose.Signer, error) {
-	if err := m.Healthy(); err != nil {
-		return nil, err
-	}
-
-	return m.keySet.Active().Signer(), nil
-}
-
-func (m *privateKeyManager) JWKs() ([]jose.JWK, error) {
-	if err := m.Healthy(); err != nil {
-		return nil, err
-	}
-
-	keys := m.keySet.Keys()
-	jwks := make([]jose.JWK, len(keys))
-	for i, k := range keys {
-		jwks[i] = k.JWK()
-	}
-	return jwks, nil
-}
-
-func (m *privateKeyManager) PublicKeys() ([]PublicKey, error) {
-	jwks, err := m.JWKs()
-	if err != nil {
-		return nil, err
-	}
-	keys := make([]PublicKey, len(jwks))
-	for i, jwk := range jwks {
-		keys[i] = *NewPublicKey(jwk)
-	}
-	return keys, nil
-}
-
-func (m *privateKeyManager) Healthy() error {
-	if m.keySet == nil {
-		return errors.New("private key manager uninitialized")
-	}
-
-	if len(m.keySet.Keys()) == 0 {
-		return errors.New("private key manager zero keys")
-	}
-
-	if m.keySet.ExpiresAt().Before(m.clock.Now().UTC()) {
-		return errors.New("private key manager keys expired")
-	}
-
-	return nil
-}
-
-func (m *privateKeyManager) Set(keySet KeySet) error {
-	privKeySet, ok := keySet.(*PrivateKeySet)
-	if !ok {
-		return errors.New("unable to cast to PrivateKeySet")
-	}
-
-	m.keySet = privKeySet
-	return nil
-}

vendor/github.com/coreos/go-oidc/key/repo.go

@@ -1,55 +0,0 @@
-package key
-
-import (
-	"errors"
-	"sync"
-)
-
-var ErrorNoKeys = errors.New("no keys found")
-
-type WritableKeySetRepo interface {
-	Set(KeySet) error
-}
-
-type ReadableKeySetRepo interface {
-	Get() (KeySet, error)
-}
-
-type PrivateKeySetRepo interface {
-	WritableKeySetRepo
-	ReadableKeySetRepo
-}
-
-func NewPrivateKeySetRepo() PrivateKeySetRepo {
-	return &memPrivateKeySetRepo{}
-}
-
-type memPrivateKeySetRepo struct {
-	mu  sync.RWMutex
-	pks PrivateKeySet
-}
-
-func (r *memPrivateKeySetRepo) Set(ks KeySet) error {
-	pks, ok := ks.(*PrivateKeySet)
-	if !ok {
-		return errors.New("unable to cast to PrivateKeySet")
-	} else if pks == nil {
-		return errors.New("nil KeySet")
-	}
-
-	r.mu.Lock()
-	defer r.mu.Unlock()
-
-	r.pks = *pks
-	return nil
-}
-
-func (r *memPrivateKeySetRepo) Get() (KeySet, error) {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-
-	if r.pks.keys == nil {
-		return nil, ErrorNoKeys
-	}
-	return KeySet(&r.pks), nil
-}

vendor/github.com/coreos/go-oidc/key/rotate.go

@@ -1,159 +0,0 @@
-package key
-
-import (
-	"errors"
-	"log"
-	"time"
-
-	ptime "github.com/coreos/pkg/timeutil"
-	"github.com/jonboulle/clockwork"
-)
-
-var (
-	ErrorPrivateKeysExpired = errors.New("private keys have expired")
-)
-
-func NewPrivateKeyRotator(repo PrivateKeySetRepo, ttl time.Duration) *PrivateKeyRotator {
-	return &PrivateKeyRotator{
-		repo: repo,
-		ttl:  ttl,
-
-		keep:        2,
-		generateKey: GeneratePrivateKey,
-		clock:       clockwork.NewRealClock(),
-	}
-}
-
-type PrivateKeyRotator struct {
-	repo        PrivateKeySetRepo
-	generateKey GeneratePrivateKeyFunc
-	clock       clockwork.Clock
-	keep        int
-	ttl         time.Duration
-}
-
-func (r *PrivateKeyRotator) expiresAt() time.Time {
-	return r.clock.Now().UTC().Add(r.ttl)
-}
-
-func (r *PrivateKeyRotator) Healthy() error {
-	pks, err := r.privateKeySet()
-	if err != nil {
-		return err
-	}
-
-	if r.clock.Now().After(pks.ExpiresAt()) {
-		return ErrorPrivateKeysExpired
-	}
-
-	return nil
-}
-
-func (r *PrivateKeyRotator) privateKeySet() (*PrivateKeySet, error) {
-	ks, err := r.repo.Get()
-	if err != nil {
-		return nil, err
-	}
-
-	pks, ok := ks.(*PrivateKeySet)
-	if !ok {
-		return nil, errors.New("unable to cast to PrivateKeySet")
-	}
-	return pks, nil
-}
-
-func (r *PrivateKeyRotator) nextRotation() (time.Duration, error) {
-	pks, err := r.privateKeySet()
-	if err == ErrorNoKeys {
-		return 0, nil
-	}
-	if err != nil {
-		return 0, err
-	}
-
-	now := r.clock.Now()
-
-	// Ideally, we want to rotate after half the TTL has elapsed.
-	idealRotationTime := pks.ExpiresAt().Add(-r.ttl / 2)
-
-	// If we are past the ideal rotation time, rotate immediatly.
-	return max(0, idealRotationTime.Sub(now)), nil
-}
-
-func max(a, b time.Duration) time.Duration {
-	if a > b {
-		return a
-	}
-	return b
-}
-
-func (r *PrivateKeyRotator) Run() chan struct{} {
-	attempt := func() {
-		k, err := r.generateKey()
-		if err != nil {
-			log.Printf("go-oidc: failed generating signing key: %v", err)
-			return
-		}
-
-		exp := r.expiresAt()
-		if err := rotatePrivateKeys(r.repo, k, r.keep, exp); err != nil {
-			log.Printf("go-oidc: key rotation failed: %v", err)
-			return
-		}
-	}
-
-	stop := make(chan struct{})
-	go func() {
-		for {
-			var nextRotation time.Duration
-			var sleep time.Duration
-			var err error
-			for {
-				if nextRotation, err = r.nextRotation(); err == nil {
-					break
-				}
-				sleep = ptime.ExpBackoff(sleep, time.Minute)
-				log.Printf("go-oidc: error getting nextRotation, retrying in %v: %v", sleep, err)
-				time.Sleep(sleep)
-			}
-
-			select {
-			case <-r.clock.After(nextRotation):
-				attempt()
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func rotatePrivateKeys(repo PrivateKeySetRepo, k *PrivateKey, keep int, exp time.Time) error {
-	ks, err := repo.Get()
-	if err != nil && err != ErrorNoKeys {
-		return err
-	}
-
-	var keys []*PrivateKey
-	if ks != nil {
-		pks, ok := ks.(*PrivateKeySet)
-		if !ok {
-			return errors.New("unable to cast to PrivateKeySet")
-		}
-		keys = pks.Keys()
-	}
-
-	keys = append([]*PrivateKey{k}, keys...)
-	if l := len(keys); l > keep {
-		keys = keys[0:keep]
-	}
-
-	nks := PrivateKeySet{
-		keys:        keys,
-		ActiveKeyID: k.ID(),
-		expiresAt:   exp,
-	}
-
-	return repo.Set(KeySet(&nks))
-}

vendor/github.com/coreos/go-oidc/key/sync.go

@@ -1,91 +0,0 @@
-package key
-
-import (
-	"errors"
-	"log"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/pkg/timeutil"
-)
-
-func NewKeySetSyncer(r ReadableKeySetRepo, w WritableKeySetRepo) *KeySetSyncer {
-	return &KeySetSyncer{
-		readable: r,
-		writable: w,
-		clock:    clockwork.NewRealClock(),
-	}
-}
-
-type KeySetSyncer struct {
-	readable ReadableKeySetRepo
-	writable WritableKeySetRepo
-	clock    clockwork.Clock
-}
-
-func (s *KeySetSyncer) Run() chan struct{} {
-	stop := make(chan struct{})
-	go func() {
-		var failing bool
-		var next time.Duration
-		for {
-			exp, err := syncKeySet(s.readable, s.writable, s.clock)
-			if err != nil || exp == 0 {
-				if !failing {
-					failing = true
-					next = time.Second
-				} else {
-					next = timeutil.ExpBackoff(next, time.Minute)
-				}
-				if exp == 0 {
-					log.Printf("Synced to already expired key set, retrying in %v: %v", next, err)
-
-				} else {
-					log.Printf("Failed syncing key set, retrying in %v: %v", next, err)
-				}
-			} else {
-				failing = false
-				next = exp / 2
-			}
-
-			select {
-			case <-s.clock.After(next):
-				continue
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func Sync(r ReadableKeySetRepo, w WritableKeySetRepo) (time.Duration, error) {
-	return syncKeySet(r, w, clockwork.NewRealClock())
-}
-
-// syncKeySet copies the keyset from r to the KeySet at w and returns the duration in which the KeySet will expire.
-// If keyset has already expired, returns a zero duration.
-func syncKeySet(r ReadableKeySetRepo, w WritableKeySetRepo, clock clockwork.Clock) (exp time.Duration, err error) {
-	var ks KeySet
-	ks, err = r.Get()
-	if err != nil {
-		return
-	}
-
-	if ks == nil {
-		err = errors.New("no source KeySet")
-		return
-	}
-
-	if err = w.Set(ks); err != nil {
-		return
-	}
-
-	now := clock.Now()
-	if ks.ExpiresAt().After(now) {
-		exp = ks.ExpiresAt().Sub(now)
-	}
-	return
-}

vendor/github.com/coreos/go-oidc/oauth2/error.go

@@ -1,29 +0,0 @@
-package oauth2
-
-const (
-	ErrorAccessDenied            = "access_denied"
-	ErrorInvalidClient           = "invalid_client"
-	ErrorInvalidGrant            = "invalid_grant"
-	ErrorInvalidRequest          = "invalid_request"
-	ErrorServerError             = "server_error"
-	ErrorUnauthorizedClient      = "unauthorized_client"
-	ErrorUnsupportedGrantType    = "unsupported_grant_type"
-	ErrorUnsupportedResponseType = "unsupported_response_type"
-)
-
-type Error struct {
-	Type        string `json:"error"`
-	Description string `json:"error_description,omitempty"`
-	State       string `json:"state,omitempty"`
-}
-
-func (e *Error) Error() string {
-	if e.Description != "" {
-		return e.Type + ": " + e.Description
-	}
-	return e.Type
-}
-
-func NewError(typ string) *Error {
-	return &Error{Type: typ}
-}

vendor/github.com/coreos/go-oidc/oauth2/oauth2.go

@@ -1,416 +0,0 @@
-package oauth2
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"mime"
-	"net/http"
-	"net/url"
-	"sort"
-	"strconv"
-	"strings"
-
-	phttp "github.com/coreos/go-oidc/http"
-)
-
-// ResponseTypesEqual compares two response_type values. If either
-// contains a space, it is treated as an unordered list. For example,
-// comparing "code id_token" and "id_token code" would evaluate to true.
-func ResponseTypesEqual(r1, r2 string) bool {
-	if !strings.Contains(r1, " ") || !strings.Contains(r2, " ") {
-		// fast route, no split needed
-		return r1 == r2
-	}
-
-	// split, sort, and compare
-	r1Fields := strings.Fields(r1)
-	r2Fields := strings.Fields(r2)
-	if len(r1Fields) != len(r2Fields) {
-		return false
-	}
-	sort.Strings(r1Fields)
-	sort.Strings(r2Fields)
-	for i, r1Field := range r1Fields {
-		if r1Field != r2Fields[i] {
-			return false
-		}
-	}
-	return true
-}
-
-const (
-	// OAuth2.0 response types registered by OIDC.
-	//
-	// See: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#RegistryContents
-	ResponseTypeCode             = "code"
-	ResponseTypeCodeIDToken      = "code id_token"
-	ResponseTypeCodeIDTokenToken = "code id_token token"
-	ResponseTypeIDToken          = "id_token"
-	ResponseTypeIDTokenToken     = "id_token token"
-	ResponseTypeToken            = "token"
-	ResponseTypeNone             = "none"
-)
-
-const (
-	GrantTypeAuthCode     = "authorization_code"
-	GrantTypeClientCreds  = "client_credentials"
-	GrantTypeUserCreds    = "password"
-	GrantTypeImplicit     = "implicit"
-	GrantTypeRefreshToken = "refresh_token"
-
-	AuthMethodClientSecretPost  = "client_secret_post"
-	AuthMethodClientSecretBasic = "client_secret_basic"
-	AuthMethodClientSecretJWT   = "client_secret_jwt"
-	AuthMethodPrivateKeyJWT     = "private_key_jwt"
-)
-
-type Config struct {
-	Credentials ClientCredentials
-	Scope       []string
-	RedirectURL string
-	AuthURL     string
-	TokenURL    string
-
-	// Must be one of the AuthMethodXXX methods above. Right now, only
-	// AuthMethodClientSecretPost and AuthMethodClientSecretBasic are supported.
-	AuthMethod string
-}
-
-type Client struct {
-	hc          phttp.Client
-	creds       ClientCredentials
-	scope       []string
-	authURL     *url.URL
-	redirectURL *url.URL
-	tokenURL    *url.URL
-	authMethod  string
-}
-
-type ClientCredentials struct {
-	ID     string
-	Secret string
-}
-
-func NewClient(hc phttp.Client, cfg Config) (c *Client, err error) {
-	if len(cfg.Credentials.ID) == 0 {
-		err = errors.New("missing client id")
-		return
-	}
-
-	if len(cfg.Credentials.Secret) == 0 {
-		err = errors.New("missing client secret")
-		return
-	}
-
-	if cfg.AuthMethod == "" {
-		cfg.AuthMethod = AuthMethodClientSecretBasic
-	} else if cfg.AuthMethod != AuthMethodClientSecretPost && cfg.AuthMethod != AuthMethodClientSecretBasic {
-		err = fmt.Errorf("auth method %q is not supported", cfg.AuthMethod)
-		return
-	}
-
-	au, err := phttp.ParseNonEmptyURL(cfg.AuthURL)
-	if err != nil {
-		return
-	}
-
-	tu, err := phttp.ParseNonEmptyURL(cfg.TokenURL)
-	if err != nil {
-		return
-	}
-
-	// Allow empty redirect URL in the case where the client
-	// only needs to verify a given token.
-	ru, err := url.Parse(cfg.RedirectURL)
-	if err != nil {
-		return
-	}
-
-	c = &Client{
-		creds:       cfg.Credentials,
-		scope:       cfg.Scope,
-		redirectURL: ru,
-		authURL:     au,
-		tokenURL:    tu,
-		hc:          hc,
-		authMethod:  cfg.AuthMethod,
-	}
-
-	return
-}
-
-// Return the embedded HTTP client
-func (c *Client) HttpClient() phttp.Client {
-	return c.hc
-}
-
-// Generate the url for initial redirect to oauth provider.
-func (c *Client) AuthCodeURL(state, accessType, prompt string) string {
-	v := c.commonURLValues()
-	v.Set("state", state)
-	if strings.ToLower(accessType) == "offline" {
-		v.Set("access_type", "offline")
-	}
-
-	if prompt != "" {
-		v.Set("prompt", prompt)
-	}
-	v.Set("response_type", "code")
-
-	q := v.Encode()
-	u := *c.authURL
-	if u.RawQuery == "" {
-		u.RawQuery = q
-	} else {
-		u.RawQuery += "&" + q
-	}
-	return u.String()
-}
-
-func (c *Client) commonURLValues() url.Values {
-	return url.Values{
-		"redirect_uri": {c.redirectURL.String()},
-		"scope":        {strings.Join(c.scope, " ")},
-		"client_id":    {c.creds.ID},
-	}
-}
-
-func (c *Client) newAuthenticatedRequest(urlToken string, values url.Values) (*http.Request, error) {
-	var req *http.Request
-	var err error
-	switch c.authMethod {
-	case AuthMethodClientSecretPost:
-		values.Set("client_secret", c.creds.Secret)
-		req, err = http.NewRequest("POST", urlToken, strings.NewReader(values.Encode()))
-		if err != nil {
-			return nil, err
-		}
-	case AuthMethodClientSecretBasic:
-		req, err = http.NewRequest("POST", urlToken, strings.NewReader(values.Encode()))
-		if err != nil {
-			return nil, err
-		}
-		encodedID := url.QueryEscape(c.creds.ID)
-		encodedSecret := url.QueryEscape(c.creds.Secret)
-		req.SetBasicAuth(encodedID, encodedSecret)
-	default:
-		panic("misconfigured client: auth method not supported")
-	}
-
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	return req, nil
-
-}
-
-// ClientCredsToken posts the client id and secret to obtain a token scoped to the OAuth2 client via the "client_credentials" grant type.
-// May not be supported by all OAuth2 servers.
-func (c *Client) ClientCredsToken(scope []string) (result TokenResponse, err error) {
-	v := url.Values{
-		"scope":      {strings.Join(scope, " ")},
-		"grant_type": {GrantTypeClientCreds},
-	}
-
-	req, err := c.newAuthenticatedRequest(c.tokenURL.String(), v)
-	if err != nil {
-		return
-	}
-
-	resp, err := c.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	return parseTokenResponse(resp)
-}
-
-// UserCredsToken posts the username and password to obtain a token scoped to the OAuth2 client via the "password" grant_type
-// May not be supported by all OAuth2 servers.
-func (c *Client) UserCredsToken(username, password string) (result TokenResponse, err error) {
-	v := url.Values{
-		"scope":      {strings.Join(c.scope, " ")},
-		"grant_type": {GrantTypeUserCreds},
-		"username":   {username},
-		"password":   {password},
-	}
-
-	req, err := c.newAuthenticatedRequest(c.tokenURL.String(), v)
-	if err != nil {
-		return
-	}
-
-	resp, err := c.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	return parseTokenResponse(resp)
-}
-
-// RequestToken requests a token from the Token Endpoint with the specified grantType.
-// If 'grantType' == GrantTypeAuthCode, then 'value' should be the authorization code.
-// If 'grantType' == GrantTypeRefreshToken, then 'value' should be the refresh token.
-func (c *Client) RequestToken(grantType, value string) (result TokenResponse, err error) {
-	v := c.commonURLValues()
-
-	v.Set("grant_type", grantType)
-	v.Set("client_secret", c.creds.Secret)
-	switch grantType {
-	case GrantTypeAuthCode:
-		v.Set("code", value)
-	case GrantTypeRefreshToken:
-		v.Set("refresh_token", value)
-	default:
-		err = fmt.Errorf("unsupported grant_type: %v", grantType)
-		return
-	}
-
-	req, err := c.newAuthenticatedRequest(c.tokenURL.String(), v)
-	if err != nil {
-		return
-	}
-
-	resp, err := c.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	return parseTokenResponse(resp)
-}
-
-func parseTokenResponse(resp *http.Response) (result TokenResponse, err error) {
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return
-	}
-	badStatusCode := resp.StatusCode < 200 || resp.StatusCode > 299
-
-	contentType, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
-	if err != nil {
-		return
-	}
-
-	result = TokenResponse{
-		RawBody: body,
-	}
-
-	newError := func(typ, desc, state string) error {
-		if typ == "" {
-			return fmt.Errorf("unrecognized error %s", body)
-		}
-		return &Error{typ, desc, state}
-	}
-
-	if contentType == "application/x-www-form-urlencoded" || contentType == "text/plain" {
-		var vals url.Values
-		vals, err = url.ParseQuery(string(body))
-		if err != nil {
-			return
-		}
-		if error := vals.Get("error"); error != "" || badStatusCode {
-			err = newError(error, vals.Get("error_description"), vals.Get("state"))
-			return
-		}
-		e := vals.Get("expires_in")
-		if e == "" {
-			e = vals.Get("expires")
-		}
-		if e != "" {
-			result.Expires, err = strconv.Atoi(e)
-			if err != nil {
-				return
-			}
-		}
-		result.AccessToken = vals.Get("access_token")
-		result.TokenType = vals.Get("token_type")
-		result.IDToken = vals.Get("id_token")
-		result.RefreshToken = vals.Get("refresh_token")
-		result.Scope = vals.Get("scope")
-	} else {
-		var r struct {
-			AccessToken  string      `json:"access_token"`
-			TokenType    string      `json:"token_type"`
-			IDToken      string      `json:"id_token"`
-			RefreshToken string      `json:"refresh_token"`
-			Scope        string      `json:"scope"`
-			State        string      `json:"state"`
-			ExpiresIn    json.Number `json:"expires_in"` // Azure AD returns string
-			Expires      int         `json:"expires"`
-			Error        string      `json:"error"`
-			Desc         string      `json:"error_description"`
-		}
-		if err = json.Unmarshal(body, &r); err != nil {
-			return
-		}
-		if r.Error != "" || badStatusCode {
-			err = newError(r.Error, r.Desc, r.State)
-			return
-		}
-		result.AccessToken = r.AccessToken
-		result.TokenType = r.TokenType
-		result.IDToken = r.IDToken
-		result.RefreshToken = r.RefreshToken
-		result.Scope = r.Scope
-		if expiresIn, err := r.ExpiresIn.Int64(); err != nil {
-			result.Expires = r.Expires
-		} else {
-			result.Expires = int(expiresIn)
-		}
-	}
-	return
-}
-
-type TokenResponse struct {
-	AccessToken  string
-	TokenType    string
-	Expires      int
-	IDToken      string
-	RefreshToken string // OPTIONAL.
-	Scope        string // OPTIONAL, if identical to the scope requested by the client, otherwise, REQUIRED.
-	RawBody      []byte // In case callers need some other non-standard info from the token response
-}
-
-type AuthCodeRequest struct {
-	ResponseType string
-	ClientID     string
-	RedirectURL  *url.URL
-	Scope        []string
-	State        string
-}
-
-func ParseAuthCodeRequest(q url.Values) (AuthCodeRequest, error) {
-	acr := AuthCodeRequest{
-		ResponseType: q.Get("response_type"),
-		ClientID:     q.Get("client_id"),
-		State:        q.Get("state"),
-		Scope:        make([]string, 0),
-	}
-
-	qs := strings.TrimSpace(q.Get("scope"))
-	if qs != "" {
-		acr.Scope = strings.Split(qs, " ")
-	}
-
-	err := func() error {
-		if acr.ClientID == "" {
-			return NewError(ErrorInvalidRequest)
-		}
-
-		redirectURL := q.Get("redirect_uri")
-		if redirectURL != "" {
-			ru, err := url.Parse(redirectURL)
-			if err != nil {
-				return NewError(ErrorInvalidRequest)
-			}
-			acr.RedirectURL = ru
-		}
-
-		return nil
-	}()
-
-	return acr, err
-}

vendor/github.com/coreos/go-oidc/oidc/client.go

@@ -1,846 +0,0 @@
-package oidc
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/mail"
-	"net/url"
-	"sync"
-	"time"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-	"github.com/coreos/go-oidc/oauth2"
-)
-
-const (
-	// amount of time that must pass after the last key sync
-	// completes before another attempt may begin
-	keySyncWindow = 5 * time.Second
-)
-
-var (
-	DefaultScope = []string{"openid", "email", "profile"}
-
-	supportedAuthMethods = map[string]struct{}{
-		oauth2.AuthMethodClientSecretBasic: struct{}{},
-		oauth2.AuthMethodClientSecretPost:  struct{}{},
-	}
-)
-
-type ClientCredentials oauth2.ClientCredentials
-
-type ClientIdentity struct {
-	Credentials ClientCredentials
-	Metadata    ClientMetadata
-}
-
-type JWAOptions struct {
-	// SigningAlg specifies an JWA alg for signing JWTs.
-	//
-	// Specifying this field implies different actions depending on the context. It may
-	// require objects be serialized and signed as a JWT instead of plain JSON, or
-	// require an existing JWT object use the specified alg.
-	//
-	// See: http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
-	SigningAlg string
-	// EncryptionAlg, if provided, specifies that the returned or sent object be stored
-	// (or nested) within a JWT object and encrypted with the provided JWA alg.
-	EncryptionAlg string
-	// EncryptionEnc specifies the JWA enc algorithm to use with EncryptionAlg. If
-	// EncryptionAlg is provided and EncryptionEnc is omitted, this field defaults
-	// to A128CBC-HS256.
-	//
-	// If EncryptionEnc is provided EncryptionAlg must also be specified.
-	EncryptionEnc string
-}
-
-func (opt JWAOptions) valid() error {
-	if opt.EncryptionEnc != "" && opt.EncryptionAlg == "" {
-		return errors.New("encryption encoding provided with no encryption algorithm")
-	}
-	return nil
-}
-
-func (opt JWAOptions) defaults() JWAOptions {
-	if opt.EncryptionAlg != "" && opt.EncryptionEnc == "" {
-		opt.EncryptionEnc = jose.EncA128CBCHS256
-	}
-	return opt
-}
-
-var (
-	// Ensure ClientMetadata satisfies these interfaces.
-	_ json.Marshaler   = &ClientMetadata{}
-	_ json.Unmarshaler = &ClientMetadata{}
-)
-
-// ClientMetadata holds metadata that the authorization server associates
-// with a client identifier. The fields range from human-facing display
-// strings such as client name, to items that impact the security of the
-// protocol, such as the list of valid redirect URIs.
-//
-// See http://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
-//
-// TODO: support language specific claim representations
-// http://openid.net/specs/openid-connect-registration-1_0.html#LanguagesAndScripts
-type ClientMetadata struct {
-	RedirectURIs []url.URL // Required
-
-	// A list of OAuth 2.0 "response_type" values that the client wishes to restrict
-	// itself to. Either "code", "token", or another registered extension.
-	//
-	// If omitted, only "code" will be used.
-	ResponseTypes []string
-	// A list of OAuth 2.0 grant types the client wishes to restrict itself to.
-	// The grant type values used by OIDC are "authorization_code", "implicit",
-	// and "refresh_token".
-	//
-	// If ommitted, only "authorization_code" will be used.
-	GrantTypes []string
-	// "native" or "web". If omitted, "web".
-	ApplicationType string
-
-	// List of email addresses.
-	Contacts []mail.Address
-	// Name of client to be presented to the end-user.
-	ClientName string
-	// URL that references a logo for the Client application.
-	LogoURI *url.URL
-	// URL of the home page of the Client.
-	ClientURI *url.URL
-	// Profile data policies and terms of use to be provided to the end user.
-	PolicyURI         *url.URL
-	TermsOfServiceURI *url.URL
-
-	// URL to or the value of the client's JSON Web Key Set document.
-	JWKSURI *url.URL
-	JWKS    *jose.JWKSet
-
-	// URL referencing a flie with a single JSON array of redirect URIs.
-	SectorIdentifierURI *url.URL
-
-	SubjectType string
-
-	// Options to restrict the JWS alg and enc values used for server responses and requests.
-	IDTokenResponseOptions  JWAOptions
-	UserInfoResponseOptions JWAOptions
-	RequestObjectOptions    JWAOptions
-
-	// Client requested authorization method and signing options for the token endpoint.
-	//
-	// Defaults to "client_secret_basic"
-	TokenEndpointAuthMethod     string
-	TokenEndpointAuthSigningAlg string
-
-	// DefaultMaxAge specifies the maximum amount of time in seconds before an authorized
-	// user must reauthroize.
-	//
-	// If 0, no limitation is placed on the maximum.
-	DefaultMaxAge int64
-	// RequireAuthTime specifies if the auth_time claim in the ID token is required.
-	RequireAuthTime bool
-
-	// Default Authentication Context Class Reference values for authentication requests.
-	DefaultACRValues []string
-
-	// URI that a third party can use to initiate a login by the relaying party.
-	//
-	// See: http://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin
-	InitiateLoginURI *url.URL
-	// Pre-registered request_uri values that may be cached by the server.
-	RequestURIs []url.URL
-}
-
-// Defaults returns a shallow copy of ClientMetadata with default
-// values replacing omitted fields.
-func (m ClientMetadata) Defaults() ClientMetadata {
-	if len(m.ResponseTypes) == 0 {
-		m.ResponseTypes = []string{oauth2.ResponseTypeCode}
-	}
-	if len(m.GrantTypes) == 0 {
-		m.GrantTypes = []string{oauth2.GrantTypeAuthCode}
-	}
-	if m.ApplicationType == "" {
-		m.ApplicationType = "web"
-	}
-	if m.TokenEndpointAuthMethod == "" {
-		m.TokenEndpointAuthMethod = oauth2.AuthMethodClientSecretBasic
-	}
-	m.IDTokenResponseOptions = m.IDTokenResponseOptions.defaults()
-	m.UserInfoResponseOptions = m.UserInfoResponseOptions.defaults()
-	m.RequestObjectOptions = m.RequestObjectOptions.defaults()
-	return m
-}
-
-func (m *ClientMetadata) MarshalJSON() ([]byte, error) {
-	e := m.toEncodableStruct()
-	return json.Marshal(&e)
-}
-
-func (m *ClientMetadata) UnmarshalJSON(data []byte) error {
-	var e encodableClientMetadata
-	if err := json.Unmarshal(data, &e); err != nil {
-		return err
-	}
-	meta, err := e.toStruct()
-	if err != nil {
-		return err
-	}
-	if err := meta.Valid(); err != nil {
-		return err
-	}
-	*m = meta
-	return nil
-}
-
-type encodableClientMetadata struct {
-	RedirectURIs                 []string     `json:"redirect_uris"` // Required
-	ResponseTypes                []string     `json:"response_types,omitempty"`
-	GrantTypes                   []string     `json:"grant_types,omitempty"`
-	ApplicationType              string       `json:"application_type,omitempty"`
-	Contacts                     []string     `json:"contacts,omitempty"`
-	ClientName                   string       `json:"client_name,omitempty"`
-	LogoURI                      string       `json:"logo_uri,omitempty"`
-	ClientURI                    string       `json:"client_uri,omitempty"`
-	PolicyURI                    string       `json:"policy_uri,omitempty"`
-	TermsOfServiceURI            string       `json:"tos_uri,omitempty"`
-	JWKSURI                      string       `json:"jwks_uri,omitempty"`
-	JWKS                         *jose.JWKSet `json:"jwks,omitempty"`
-	SectorIdentifierURI          string       `json:"sector_identifier_uri,omitempty"`
-	SubjectType                  string       `json:"subject_type,omitempty"`
-	IDTokenSignedResponseAlg     string       `json:"id_token_signed_response_alg,omitempty"`
-	IDTokenEncryptedResponseAlg  string       `json:"id_token_encrypted_response_alg,omitempty"`
-	IDTokenEncryptedResponseEnc  string       `json:"id_token_encrypted_response_enc,omitempty"`
-	UserInfoSignedResponseAlg    string       `json:"userinfo_signed_response_alg,omitempty"`
-	UserInfoEncryptedResponseAlg string       `json:"userinfo_encrypted_response_alg,omitempty"`
-	UserInfoEncryptedResponseEnc string       `json:"userinfo_encrypted_response_enc,omitempty"`
-	RequestObjectSigningAlg      string       `json:"request_object_signing_alg,omitempty"`
-	RequestObjectEncryptionAlg   string       `json:"request_object_encryption_alg,omitempty"`
-	RequestObjectEncryptionEnc   string       `json:"request_object_encryption_enc,omitempty"`
-	TokenEndpointAuthMethod      string       `json:"token_endpoint_auth_method,omitempty"`
-	TokenEndpointAuthSigningAlg  string       `json:"token_endpoint_auth_signing_alg,omitempty"`
-	DefaultMaxAge                int64        `json:"default_max_age,omitempty"`
-	RequireAuthTime              bool         `json:"require_auth_time,omitempty"`
-	DefaultACRValues             []string     `json:"default_acr_values,omitempty"`
-	InitiateLoginURI             string       `json:"initiate_login_uri,omitempty"`
-	RequestURIs                  []string     `json:"request_uris,omitempty"`
-}
-
-func (c *encodableClientMetadata) toStruct() (ClientMetadata, error) {
-	p := stickyErrParser{}
-	m := ClientMetadata{
-		RedirectURIs:                p.parseURIs(c.RedirectURIs, "redirect_uris"),
-		ResponseTypes:               c.ResponseTypes,
-		GrantTypes:                  c.GrantTypes,
-		ApplicationType:             c.ApplicationType,
-		Contacts:                    p.parseEmails(c.Contacts, "contacts"),
-		ClientName:                  c.ClientName,
-		LogoURI:                     p.parseURI(c.LogoURI, "logo_uri"),
-		ClientURI:                   p.parseURI(c.ClientURI, "client_uri"),
-		PolicyURI:                   p.parseURI(c.PolicyURI, "policy_uri"),
-		TermsOfServiceURI:           p.parseURI(c.TermsOfServiceURI, "tos_uri"),
-		JWKSURI:                     p.parseURI(c.JWKSURI, "jwks_uri"),
-		JWKS:                        c.JWKS,
-		SectorIdentifierURI:         p.parseURI(c.SectorIdentifierURI, "sector_identifier_uri"),
-		SubjectType:                 c.SubjectType,
-		TokenEndpointAuthMethod:     c.TokenEndpointAuthMethod,
-		TokenEndpointAuthSigningAlg: c.TokenEndpointAuthSigningAlg,
-		DefaultMaxAge:               c.DefaultMaxAge,
-		RequireAuthTime:             c.RequireAuthTime,
-		DefaultACRValues:            c.DefaultACRValues,
-		InitiateLoginURI:            p.parseURI(c.InitiateLoginURI, "initiate_login_uri"),
-		RequestURIs:                 p.parseURIs(c.RequestURIs, "request_uris"),
-		IDTokenResponseOptions: JWAOptions{
-			c.IDTokenSignedResponseAlg,
-			c.IDTokenEncryptedResponseAlg,
-			c.IDTokenEncryptedResponseEnc,
-		},
-		UserInfoResponseOptions: JWAOptions{
-			c.UserInfoSignedResponseAlg,
-			c.UserInfoEncryptedResponseAlg,
-			c.UserInfoEncryptedResponseEnc,
-		},
-		RequestObjectOptions: JWAOptions{
-			c.RequestObjectSigningAlg,
-			c.RequestObjectEncryptionAlg,
-			c.RequestObjectEncryptionEnc,
-		},
-	}
-	if p.firstErr != nil {
-		return ClientMetadata{}, p.firstErr
-	}
-	return m, nil
-}
-
-// stickyErrParser parses URIs and email addresses. Once it encounters
-// a parse error, subsequent calls become no-op.
-type stickyErrParser struct {
-	firstErr error
-}
-
-func (p *stickyErrParser) parseURI(s, field string) *url.URL {
-	if p.firstErr != nil || s == "" {
-		return nil
-	}
-	u, err := url.Parse(s)
-	if err == nil {
-		if u.Host == "" {
-			err = errors.New("no host in URI")
-		} else if u.Scheme != "http" && u.Scheme != "https" {
-			err = errors.New("invalid URI scheme")
-		}
-	}
-	if err != nil {
-		p.firstErr = fmt.Errorf("failed to parse %s: %v", field, err)
-		return nil
-	}
-	return u
-}
-
-func (p *stickyErrParser) parseURIs(s []string, field string) []url.URL {
-	if p.firstErr != nil || len(s) == 0 {
-		return nil
-	}
-	uris := make([]url.URL, len(s))
-	for i, val := range s {
-		if val == "" {
-			p.firstErr = fmt.Errorf("invalid URI in field %s", field)
-			return nil
-		}
-		if u := p.parseURI(val, field); u != nil {
-			uris[i] = *u
-		}
-	}
-	return uris
-}
-
-func (p *stickyErrParser) parseEmails(s []string, field string) []mail.Address {
-	if p.firstErr != nil || len(s) == 0 {
-		return nil
-	}
-	addrs := make([]mail.Address, len(s))
-	for i, addr := range s {
-		if addr == "" {
-			p.firstErr = fmt.Errorf("invalid email in field %s", field)
-			return nil
-		}
-		a, err := mail.ParseAddress(addr)
-		if err != nil {
-			p.firstErr = fmt.Errorf("invalid email in field %s: %v", field, err)
-			return nil
-		}
-		addrs[i] = *a
-	}
-	return addrs
-}
-
-func (m *ClientMetadata) toEncodableStruct() encodableClientMetadata {
-	return encodableClientMetadata{
-		RedirectURIs:                 urisToStrings(m.RedirectURIs),
-		ResponseTypes:                m.ResponseTypes,
-		GrantTypes:                   m.GrantTypes,
-		ApplicationType:              m.ApplicationType,
-		Contacts:                     emailsToStrings(m.Contacts),
-		ClientName:                   m.ClientName,
-		LogoURI:                      uriToString(m.LogoURI),
-		ClientURI:                    uriToString(m.ClientURI),
-		PolicyURI:                    uriToString(m.PolicyURI),
-		TermsOfServiceURI:            uriToString(m.TermsOfServiceURI),
-		JWKSURI:                      uriToString(m.JWKSURI),
-		JWKS:                         m.JWKS,
-		SectorIdentifierURI:          uriToString(m.SectorIdentifierURI),
-		SubjectType:                  m.SubjectType,
-		IDTokenSignedResponseAlg:     m.IDTokenResponseOptions.SigningAlg,
-		IDTokenEncryptedResponseAlg:  m.IDTokenResponseOptions.EncryptionAlg,
-		IDTokenEncryptedResponseEnc:  m.IDTokenResponseOptions.EncryptionEnc,
-		UserInfoSignedResponseAlg:    m.UserInfoResponseOptions.SigningAlg,
-		UserInfoEncryptedResponseAlg: m.UserInfoResponseOptions.EncryptionAlg,
-		UserInfoEncryptedResponseEnc: m.UserInfoResponseOptions.EncryptionEnc,
-		RequestObjectSigningAlg:      m.RequestObjectOptions.SigningAlg,
-		RequestObjectEncryptionAlg:   m.RequestObjectOptions.EncryptionAlg,
-		RequestObjectEncryptionEnc:   m.RequestObjectOptions.EncryptionEnc,
-		TokenEndpointAuthMethod:      m.TokenEndpointAuthMethod,
-		TokenEndpointAuthSigningAlg:  m.TokenEndpointAuthSigningAlg,
-		DefaultMaxAge:                m.DefaultMaxAge,
-		RequireAuthTime:              m.RequireAuthTime,
-		DefaultACRValues:             m.DefaultACRValues,
-		InitiateLoginURI:             uriToString(m.InitiateLoginURI),
-		RequestURIs:                  urisToStrings(m.RequestURIs),
-	}
-}
-
-func uriToString(u *url.URL) string {
-	if u == nil {
-		return ""
-	}
-	return u.String()
-}
-
-func urisToStrings(urls []url.URL) []string {
-	if len(urls) == 0 {
-		return nil
-	}
-	sli := make([]string, len(urls))
-	for i, u := range urls {
-		sli[i] = u.String()
-	}
-	return sli
-}
-
-func emailsToStrings(addrs []mail.Address) []string {
-	if len(addrs) == 0 {
-		return nil
-	}
-	sli := make([]string, len(addrs))
-	for i, addr := range addrs {
-		sli[i] = addr.String()
-	}
-	return sli
-}
-
-// Valid determines if a ClientMetadata conforms with the OIDC specification.
-//
-// Valid is called by UnmarshalJSON.
-//
-// NOTE(ericchiang): For development purposes Valid does not mandate 'https' for
-// URLs fields where the OIDC spec requires it. This may change in future releases
-// of this package. See: https://github.com/coreos/go-oidc/issues/34
-func (m *ClientMetadata) Valid() error {
-	if len(m.RedirectURIs) == 0 {
-		return errors.New("zero redirect URLs")
-	}
-
-	validURI := func(u *url.URL, fieldName string) error {
-		if u.Host == "" {
-			return fmt.Errorf("no host for uri field %s", fieldName)
-		}
-		if u.Scheme != "http" && u.Scheme != "https" {
-			return fmt.Errorf("uri field %s scheme is not http or https", fieldName)
-		}
-		return nil
-	}
-
-	uris := []struct {
-		val  *url.URL
-		name string
-	}{
-		{m.LogoURI, "logo_uri"},
-		{m.ClientURI, "client_uri"},
-		{m.PolicyURI, "policy_uri"},
-		{m.TermsOfServiceURI, "tos_uri"},
-		{m.JWKSURI, "jwks_uri"},
-		{m.SectorIdentifierURI, "sector_identifier_uri"},
-		{m.InitiateLoginURI, "initiate_login_uri"},
-	}
-
-	for _, uri := range uris {
-		if uri.val == nil {
-			continue
-		}
-		if err := validURI(uri.val, uri.name); err != nil {
-			return err
-		}
-	}
-
-	uriLists := []struct {
-		vals []url.URL
-		name string
-	}{
-		{m.RedirectURIs, "redirect_uris"},
-		{m.RequestURIs, "request_uris"},
-	}
-	for _, list := range uriLists {
-		for _, uri := range list.vals {
-			if err := validURI(&uri, list.name); err != nil {
-				return err
-			}
-		}
-	}
-
-	options := []struct {
-		option JWAOptions
-		name   string
-	}{
-		{m.IDTokenResponseOptions, "id_token response"},
-		{m.UserInfoResponseOptions, "userinfo response"},
-		{m.RequestObjectOptions, "request_object"},
-	}
-	for _, option := range options {
-		if err := option.option.valid(); err != nil {
-			return fmt.Errorf("invalid JWA values for %s: %v", option.name, err)
-		}
-	}
-	return nil
-}
-
-type ClientRegistrationResponse struct {
-	ClientID                string // Required
-	ClientSecret            string
-	RegistrationAccessToken string
-	RegistrationClientURI   string
-	// If IsZero is true, unspecified.
-	ClientIDIssuedAt time.Time
-	// Time at which the client_secret will expire.
-	// If IsZero is true, it will not expire.
-	ClientSecretExpiresAt time.Time
-
-	ClientMetadata
-}
-
-type encodableClientRegistrationResponse struct {
-	ClientID                string `json:"client_id"` // Required
-	ClientSecret            string `json:"client_secret,omitempty"`
-	RegistrationAccessToken string `json:"registration_access_token,omitempty"`
-	RegistrationClientURI   string `json:"registration_client_uri,omitempty"`
-	ClientIDIssuedAt        int64  `json:"client_id_issued_at,omitempty"`
-	// Time at which the client_secret will expire, in seconds since the epoch.
-	// If 0 it will not expire.
-	ClientSecretExpiresAt int64 `json:"client_secret_expires_at"` // Required
-
-	encodableClientMetadata
-}
-
-func unixToSec(t time.Time) int64 {
-	if t.IsZero() {
-		return 0
-	}
-	return t.Unix()
-}
-
-func (c *ClientRegistrationResponse) MarshalJSON() ([]byte, error) {
-	e := encodableClientRegistrationResponse{
-		ClientID:                c.ClientID,
-		ClientSecret:            c.ClientSecret,
-		RegistrationAccessToken: c.RegistrationAccessToken,
-		RegistrationClientURI:   c.RegistrationClientURI,
-		ClientIDIssuedAt:        unixToSec(c.ClientIDIssuedAt),
-		ClientSecretExpiresAt:   unixToSec(c.ClientSecretExpiresAt),
-		encodableClientMetadata: c.ClientMetadata.toEncodableStruct(),
-	}
-	return json.Marshal(&e)
-}
-
-func secToUnix(sec int64) time.Time {
-	if sec == 0 {
-		return time.Time{}
-	}
-	return time.Unix(sec, 0)
-}
-
-func (c *ClientRegistrationResponse) UnmarshalJSON(data []byte) error {
-	var e encodableClientRegistrationResponse
-	if err := json.Unmarshal(data, &e); err != nil {
-		return err
-	}
-	if e.ClientID == "" {
-		return errors.New("no client_id in client registration response")
-	}
-	metadata, err := e.encodableClientMetadata.toStruct()
-	if err != nil {
-		return err
-	}
-	*c = ClientRegistrationResponse{
-		ClientID:                e.ClientID,
-		ClientSecret:            e.ClientSecret,
-		RegistrationAccessToken: e.RegistrationAccessToken,
-		RegistrationClientURI:   e.RegistrationClientURI,
-		ClientIDIssuedAt:        secToUnix(e.ClientIDIssuedAt),
-		ClientSecretExpiresAt:   secToUnix(e.ClientSecretExpiresAt),
-		ClientMetadata:          metadata,
-	}
-	return nil
-}
-
-type ClientConfig struct {
-	HTTPClient     phttp.Client
-	Credentials    ClientCredentials
-	Scope          []string
-	RedirectURL    string
-	ProviderConfig ProviderConfig
-	KeySet         key.PublicKeySet
-}
-
-func NewClient(cfg ClientConfig) (*Client, error) {
-	// Allow empty redirect URL in the case where the client
-	// only needs to verify a given token.
-	ru, err := url.Parse(cfg.RedirectURL)
-	if err != nil {
-		return nil, fmt.Errorf("invalid redirect URL: %v", err)
-	}
-
-	c := Client{
-		credentials:    cfg.Credentials,
-		httpClient:     cfg.HTTPClient,
-		scope:          cfg.Scope,
-		redirectURL:    ru.String(),
-		providerConfig: newProviderConfigRepo(cfg.ProviderConfig),
-		keySet:         cfg.KeySet,
-	}
-
-	if c.httpClient == nil {
-		c.httpClient = http.DefaultClient
-	}
-
-	if c.scope == nil {
-		c.scope = make([]string, len(DefaultScope))
-		copy(c.scope, DefaultScope)
-	}
-
-	return &c, nil
-}
-
-type Client struct {
-	httpClient     phttp.Client
-	providerConfig *providerConfigRepo
-	credentials    ClientCredentials
-	redirectURL    string
-	scope          []string
-	keySet         key.PublicKeySet
-	providerSyncer *ProviderConfigSyncer
-
-	keySetSyncMutex sync.RWMutex
-	lastKeySetSync  time.Time
-}
-
-func (c *Client) Healthy() error {
-	now := time.Now().UTC()
-
-	cfg := c.providerConfig.Get()
-
-	if cfg.Empty() {
-		return errors.New("oidc client provider config empty")
-	}
-
-	if !cfg.ExpiresAt.IsZero() && cfg.ExpiresAt.Before(now) {
-		return errors.New("oidc client provider config expired")
-	}
-
-	return nil
-}
-
-func (c *Client) OAuthClient() (*oauth2.Client, error) {
-	cfg := c.providerConfig.Get()
-	authMethod, err := chooseAuthMethod(cfg)
-	if err != nil {
-		return nil, err
-	}
-
-	ocfg := oauth2.Config{
-		Credentials: oauth2.ClientCredentials(c.credentials),
-		RedirectURL: c.redirectURL,
-		AuthURL:     cfg.AuthEndpoint.String(),
-		TokenURL:    cfg.TokenEndpoint.String(),
-		Scope:       c.scope,
-		AuthMethod:  authMethod,
-	}
-
-	return oauth2.NewClient(c.httpClient, ocfg)
-}
-
-func chooseAuthMethod(cfg ProviderConfig) (string, error) {
-	if len(cfg.TokenEndpointAuthMethodsSupported) == 0 {
-		return oauth2.AuthMethodClientSecretBasic, nil
-	}
-
-	for _, authMethod := range cfg.TokenEndpointAuthMethodsSupported {
-		if _, ok := supportedAuthMethods[authMethod]; ok {
-			return authMethod, nil
-		}
-	}
-
-	return "", errors.New("no supported auth methods")
-}
-
-// SyncProviderConfig starts the provider config syncer
-func (c *Client) SyncProviderConfig(discoveryURL string) chan struct{} {
-	r := NewHTTPProviderConfigGetter(c.httpClient, discoveryURL)
-	s := NewProviderConfigSyncer(r, c.providerConfig)
-	stop := s.Run()
-	s.WaitUntilInitialSync()
-	return stop
-}
-
-func (c *Client) maybeSyncKeys() error {
-	tooSoon := func() bool {
-		return time.Now().UTC().Before(c.lastKeySetSync.Add(keySyncWindow))
-	}
-
-	// ignore request to sync keys if a sync operation has been
-	// attempted too recently
-	if tooSoon() {
-		return nil
-	}
-
-	c.keySetSyncMutex.Lock()
-	defer c.keySetSyncMutex.Unlock()
-
-	// check again, as another goroutine may have been holding
-	// the lock while updating the keys
-	if tooSoon() {
-		return nil
-	}
-
-	cfg := c.providerConfig.Get()
-	r := NewRemotePublicKeyRepo(c.httpClient, cfg.KeysEndpoint.String())
-	w := &clientKeyRepo{client: c}
-	_, err := key.Sync(r, w)
-	c.lastKeySetSync = time.Now().UTC()
-
-	return err
-}
-
-type clientKeyRepo struct {
-	client *Client
-}
-
-func (r *clientKeyRepo) Set(ks key.KeySet) error {
-	pks, ok := ks.(*key.PublicKeySet)
-	if !ok {
-		return errors.New("unable to cast to PublicKey")
-	}
-	r.client.keySet = *pks
-	return nil
-}
-
-func (c *Client) ClientCredsToken(scope []string) (jose.JWT, error) {
-	cfg := c.providerConfig.Get()
-
-	if !cfg.SupportsGrantType(oauth2.GrantTypeClientCreds) {
-		return jose.JWT{}, fmt.Errorf("%v grant type is not supported", oauth2.GrantTypeClientCreds)
-	}
-
-	oac, err := c.OAuthClient()
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	t, err := oac.ClientCredsToken(scope)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	jwt, err := jose.ParseJWT(t.IDToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	return jwt, c.VerifyJWT(jwt)
-}
-
-// ExchangeAuthCode exchanges an OAuth2 auth code for an OIDC JWT ID token.
-func (c *Client) ExchangeAuthCode(code string) (jose.JWT, error) {
-	oac, err := c.OAuthClient()
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	t, err := oac.RequestToken(oauth2.GrantTypeAuthCode, code)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	jwt, err := jose.ParseJWT(t.IDToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	return jwt, c.VerifyJWT(jwt)
-}
-
-// RefreshToken uses a refresh token to exchange for a new OIDC JWT ID Token.
-func (c *Client) RefreshToken(refreshToken string) (jose.JWT, error) {
-	oac, err := c.OAuthClient()
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	t, err := oac.RequestToken(oauth2.GrantTypeRefreshToken, refreshToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	jwt, err := jose.ParseJWT(t.IDToken)
-	if err != nil {
-		return jose.JWT{}, err
-	}
-
-	return jwt, c.VerifyJWT(jwt)
-}
-
-func (c *Client) VerifyJWT(jwt jose.JWT) error {
-	var keysFunc func() []key.PublicKey
-	if kID, ok := jwt.KeyID(); ok {
-		keysFunc = c.keysFuncWithID(kID)
-	} else {
-		keysFunc = c.keysFuncAll()
-	}
-
-	v := NewJWTVerifier(
-		c.providerConfig.Get().Issuer.String(),
-		c.credentials.ID,
-		c.maybeSyncKeys, keysFunc)
-
-	return v.Verify(jwt)
-}
-
-// keysFuncWithID returns a function that retrieves at most unexpired
-// public key from the Client that matches the provided ID
-func (c *Client) keysFuncWithID(kID string) func() []key.PublicKey {
-	return func() []key.PublicKey {
-		c.keySetSyncMutex.RLock()
-		defer c.keySetSyncMutex.RUnlock()
-
-		if c.keySet.ExpiresAt().Before(time.Now()) {
-			return []key.PublicKey{}
-		}
-
-		k := c.keySet.Key(kID)
-		if k == nil {
-			return []key.PublicKey{}
-		}
-
-		return []key.PublicKey{*k}
-	}
-}
-
-// keysFuncAll returns a function that retrieves all unexpired public
-// keys from the Client
-func (c *Client) keysFuncAll() func() []key.PublicKey {
-	return func() []key.PublicKey {
-		c.keySetSyncMutex.RLock()
-		defer c.keySetSyncMutex.RUnlock()
-
-		if c.keySet.ExpiresAt().Before(time.Now()) {
-			return []key.PublicKey{}
-		}
-
-		return c.keySet.Keys()
-	}
-}
-
-type providerConfigRepo struct {
-	mu     sync.RWMutex
-	config ProviderConfig // do not access directly, use Get()
-}
-
-func newProviderConfigRepo(pc ProviderConfig) *providerConfigRepo {
-	return &providerConfigRepo{sync.RWMutex{}, pc}
-}
-
-// returns an error to implement ProviderConfigSetter
-func (r *providerConfigRepo) Set(cfg ProviderConfig) error {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.config = cfg
-	return nil
-}
-
-func (r *providerConfigRepo) Get() ProviderConfig {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-	return r.config
-}

vendor/github.com/coreos/go-oidc/oidc/identity.go

@@ -1,44 +0,0 @@
-package oidc
-
-import (
-	"errors"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-type Identity struct {
-	ID        string
-	Name      string
-	Email     string
-	ExpiresAt time.Time
-}
-
-func IdentityFromClaims(claims jose.Claims) (*Identity, error) {
-	if claims == nil {
-		return nil, errors.New("nil claim set")
-	}
-
-	var ident Identity
-	var err error
-	var ok bool
-
-	if ident.ID, ok, err = claims.StringClaim("sub"); err != nil {
-		return nil, err
-	} else if !ok {
-		return nil, errors.New("missing required claim: sub")
-	}
-
-	if ident.Email, _, err = claims.StringClaim("email"); err != nil {
-		return nil, err
-	}
-
-	exp, ok, err := claims.TimeClaim("exp")
-	if err != nil {
-		return nil, err
-	} else if ok {
-		ident.ExpiresAt = exp
-	}
-
-	return &ident, nil
-}

vendor/github.com/coreos/go-oidc/oidc/interface.go

@@ -1,3 +0,0 @@
-package oidc
-
-type LoginFunc func(ident Identity, sessionKey string) (redirectURL string, err error)

vendor/github.com/coreos/go-oidc/oidc/key.go

@@ -1,67 +0,0 @@
-package oidc
-
-import (
-	"encoding/json"
-	"errors"
-	"net/http"
-	"time"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-)
-
-// DefaultPublicKeySetTTL is the default TTL set on the PublicKeySet if no
-// Cache-Control header is provided by the JWK Set document endpoint.
-const DefaultPublicKeySetTTL = 24 * time.Hour
-
-// NewRemotePublicKeyRepo is responsible for fetching the JWK Set document.
-func NewRemotePublicKeyRepo(hc phttp.Client, ep string) *remotePublicKeyRepo {
-	return &remotePublicKeyRepo{hc: hc, ep: ep}
-}
-
-type remotePublicKeyRepo struct {
-	hc phttp.Client
-	ep string
-}
-
-// Get returns a PublicKeySet fetched from the JWK Set document endpoint. A TTL
-// is set on the Key Set to avoid it having to be re-retrieved for every
-// encryption event. This TTL is typically controlled by the endpoint returning
-// a Cache-Control header, but defaults to 24 hours if no Cache-Control header
-// is found.
-func (r *remotePublicKeyRepo) Get() (key.KeySet, error) {
-	req, err := http.NewRequest("GET", r.ep, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	resp, err := r.hc.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var d struct {
-		Keys []jose.JWK `json:"keys"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&d); err != nil {
-		return nil, err
-	}
-
-	if len(d.Keys) == 0 {
-		return nil, errors.New("zero keys in response")
-	}
-
-	ttl, ok, err := phttp.Cacheable(resp.Header)
-	if err != nil {
-		return nil, err
-	}
-	if !ok {
-		ttl = DefaultPublicKeySetTTL
-	}
-
-	exp := time.Now().UTC().Add(ttl)
-	ks := key.NewPublicKeySet(d.Keys, exp)
-	return ks, nil
-}

vendor/github.com/coreos/go-oidc/oidc/provider.go

@@ -1,690 +0,0 @@
-package oidc
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"log"
-	"net/http"
-	"net/url"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/coreos/pkg/timeutil"
-	"github.com/jonboulle/clockwork"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/oauth2"
-)
-
-const (
-	// Subject Identifier types defined by the OIDC spec. Specifies if the provider
-	// should provide the same sub claim value to all clients (public) or a unique
-	// value for each client (pairwise).
-	//
-	// See: http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes
-	SubjectTypePublic   = "public"
-	SubjectTypePairwise = "pairwise"
-)
-
-var (
-	// Default values for omitted provider config fields.
-	//
-	// Use ProviderConfig's Defaults method to fill a provider config with these values.
-	DefaultGrantTypesSupported               = []string{oauth2.GrantTypeAuthCode, oauth2.GrantTypeImplicit}
-	DefaultResponseModesSupported            = []string{"query", "fragment"}
-	DefaultTokenEndpointAuthMethodsSupported = []string{oauth2.AuthMethodClientSecretBasic}
-	DefaultClaimTypesSupported               = []string{"normal"}
-)
-
-const (
-	MaximumProviderConfigSyncInterval = 24 * time.Hour
-	MinimumProviderConfigSyncInterval = time.Minute
-
-	discoveryConfigPath = "/.well-known/openid-configuration"
-)
-
-// internally configurable for tests
-var minimumProviderConfigSyncInterval = MinimumProviderConfigSyncInterval
-
-var (
-	// Ensure ProviderConfig satisfies these interfaces.
-	_ json.Marshaler   = &ProviderConfig{}
-	_ json.Unmarshaler = &ProviderConfig{}
-)
-
-// ProviderConfig represents the OpenID Provider Metadata specifying what
-// configurations a provider supports.
-//
-// See: http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
-type ProviderConfig struct {
-	Issuer               *url.URL // Required
-	AuthEndpoint         *url.URL // Required
-	TokenEndpoint        *url.URL // Required if grant types other than "implicit" are supported
-	UserInfoEndpoint     *url.URL
-	KeysEndpoint         *url.URL // Required
-	RegistrationEndpoint *url.URL
-	EndSessionEndpoint   *url.URL
-	CheckSessionIFrame   *url.URL
-
-	// Servers MAY choose not to advertise some supported scope values even when this
-	// parameter is used, although those defined in OpenID Core SHOULD be listed, if supported.
-	ScopesSupported []string
-	// OAuth2.0 response types supported.
-	ResponseTypesSupported []string // Required
-	// OAuth2.0 response modes supported.
-	//
-	// If omitted, defaults to DefaultResponseModesSupported.
-	ResponseModesSupported []string
-	// OAuth2.0 grant types supported.
-	//
-	// If omitted, defaults to DefaultGrantTypesSupported.
-	GrantTypesSupported []string
-	ACRValuesSupported  []string
-	// SubjectTypesSupported specifies strategies for providing values for the sub claim.
-	SubjectTypesSupported []string // Required
-
-	// JWA signing and encryption algorith values supported for ID tokens.
-	IDTokenSigningAlgValues    []string // Required
-	IDTokenEncryptionAlgValues []string
-	IDTokenEncryptionEncValues []string
-
-	// JWA signing and encryption algorith values supported for user info responses.
-	UserInfoSigningAlgValues    []string
-	UserInfoEncryptionAlgValues []string
-	UserInfoEncryptionEncValues []string
-
-	// JWA signing and encryption algorith values supported for request objects.
-	ReqObjSigningAlgValues    []string
-	ReqObjEncryptionAlgValues []string
-	ReqObjEncryptionEncValues []string
-
-	TokenEndpointAuthMethodsSupported          []string
-	TokenEndpointAuthSigningAlgValuesSupported []string
-	DisplayValuesSupported                     []string
-	ClaimTypesSupported                        []string
-	ClaimsSupported                            []string
-	ServiceDocs                                *url.URL
-	ClaimsLocalsSupported                      []string
-	UILocalsSupported                          []string
-	ClaimsParameterSupported                   bool
-	RequestParameterSupported                  bool
-	RequestURIParamaterSupported               bool
-	RequireRequestURIRegistration              bool
-
-	Policy         *url.URL
-	TermsOfService *url.URL
-
-	// Not part of the OpenID Provider Metadata
-	ExpiresAt time.Time
-}
-
-// Defaults returns a shallow copy of ProviderConfig with default
-// values replacing omitted fields.
-//
-//     var cfg oidc.ProviderConfig
-//     // Fill provider config with default values for omitted fields.
-//     cfg = cfg.Defaults()
-//
-func (p ProviderConfig) Defaults() ProviderConfig {
-	setDefault := func(val *[]string, defaultVal []string) {
-		if len(*val) == 0 {
-			*val = defaultVal
-		}
-	}
-	setDefault(&p.GrantTypesSupported, DefaultGrantTypesSupported)
-	setDefault(&p.ResponseModesSupported, DefaultResponseModesSupported)
-	setDefault(&p.TokenEndpointAuthMethodsSupported, DefaultTokenEndpointAuthMethodsSupported)
-	setDefault(&p.ClaimTypesSupported, DefaultClaimTypesSupported)
-	return p
-}
-
-func (p *ProviderConfig) MarshalJSON() ([]byte, error) {
-	e := p.toEncodableStruct()
-	return json.Marshal(&e)
-}
-
-func (p *ProviderConfig) UnmarshalJSON(data []byte) error {
-	var e encodableProviderConfig
-	if err := json.Unmarshal(data, &e); err != nil {
-		return err
-	}
-	conf, err := e.toStruct()
-	if err != nil {
-		return err
-	}
-	if err := conf.Valid(); err != nil {
-		return err
-	}
-	*p = conf
-	return nil
-}
-
-type encodableProviderConfig struct {
-	Issuer               string `json:"issuer"`
-	AuthEndpoint         string `json:"authorization_endpoint"`
-	TokenEndpoint        string `json:"token_endpoint"`
-	UserInfoEndpoint     string `json:"userinfo_endpoint,omitempty"`
-	KeysEndpoint         string `json:"jwks_uri"`
-	RegistrationEndpoint string `json:"registration_endpoint,omitempty"`
-	EndSessionEndpoint   string `json:"end_session_endpoint,omitempty"`
-	CheckSessionIFrame   string `json:"check_session_iframe,omitempty"`
-
-	// Use 'omitempty' for all slices as per OIDC spec:
-	// "Claims that return multiple values are represented as JSON arrays.
-	// Claims with zero elements MUST be omitted from the response."
-	// http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse
-
-	ScopesSupported        []string `json:"scopes_supported,omitempty"`
-	ResponseTypesSupported []string `json:"response_types_supported,omitempty"`
-	ResponseModesSupported []string `json:"response_modes_supported,omitempty"`
-	GrantTypesSupported    []string `json:"grant_types_supported,omitempty"`
-	ACRValuesSupported     []string `json:"acr_values_supported,omitempty"`
-	SubjectTypesSupported  []string `json:"subject_types_supported,omitempty"`
-
-	IDTokenSigningAlgValues     []string `json:"id_token_signing_alg_values_supported,omitempty"`
-	IDTokenEncryptionAlgValues  []string `json:"id_token_encryption_alg_values_supported,omitempty"`
-	IDTokenEncryptionEncValues  []string `json:"id_token_encryption_enc_values_supported,omitempty"`
-	UserInfoSigningAlgValues    []string `json:"userinfo_signing_alg_values_supported,omitempty"`
-	UserInfoEncryptionAlgValues []string `json:"userinfo_encryption_alg_values_supported,omitempty"`
-	UserInfoEncryptionEncValues []string `json:"userinfo_encryption_enc_values_supported,omitempty"`
-	ReqObjSigningAlgValues      []string `json:"request_object_signing_alg_values_supported,omitempty"`
-	ReqObjEncryptionAlgValues   []string `json:"request_object_encryption_alg_values_supported,omitempty"`
-	ReqObjEncryptionEncValues   []string `json:"request_object_encryption_enc_values_supported,omitempty"`
-
-	TokenEndpointAuthMethodsSupported          []string `json:"token_endpoint_auth_methods_supported,omitempty"`
-	TokenEndpointAuthSigningAlgValuesSupported []string `json:"token_endpoint_auth_signing_alg_values_supported,omitempty"`
-
-	DisplayValuesSupported        []string `json:"display_values_supported,omitempty"`
-	ClaimTypesSupported           []string `json:"claim_types_supported,omitempty"`
-	ClaimsSupported               []string `json:"claims_supported,omitempty"`
-	ServiceDocs                   string   `json:"service_documentation,omitempty"`
-	ClaimsLocalsSupported         []string `json:"claims_locales_supported,omitempty"`
-	UILocalsSupported             []string `json:"ui_locales_supported,omitempty"`
-	ClaimsParameterSupported      bool     `json:"claims_parameter_supported,omitempty"`
-	RequestParameterSupported     bool     `json:"request_parameter_supported,omitempty"`
-	RequestURIParamaterSupported  bool     `json:"request_uri_parameter_supported,omitempty"`
-	RequireRequestURIRegistration bool     `json:"require_request_uri_registration,omitempty"`
-
-	Policy         string `json:"op_policy_uri,omitempty"`
-	TermsOfService string `json:"op_tos_uri,omitempty"`
-}
-
-func (cfg ProviderConfig) toEncodableStruct() encodableProviderConfig {
-	return encodableProviderConfig{
-		Issuer:                                     uriToString(cfg.Issuer),
-		AuthEndpoint:                               uriToString(cfg.AuthEndpoint),
-		TokenEndpoint:                              uriToString(cfg.TokenEndpoint),
-		UserInfoEndpoint:                           uriToString(cfg.UserInfoEndpoint),
-		KeysEndpoint:                               uriToString(cfg.KeysEndpoint),
-		RegistrationEndpoint:                       uriToString(cfg.RegistrationEndpoint),
-		EndSessionEndpoint:                         uriToString(cfg.EndSessionEndpoint),
-		CheckSessionIFrame:                         uriToString(cfg.CheckSessionIFrame),
-		ScopesSupported:                            cfg.ScopesSupported,
-		ResponseTypesSupported:                     cfg.ResponseTypesSupported,
-		ResponseModesSupported:                     cfg.ResponseModesSupported,
-		GrantTypesSupported:                        cfg.GrantTypesSupported,
-		ACRValuesSupported:                         cfg.ACRValuesSupported,
-		SubjectTypesSupported:                      cfg.SubjectTypesSupported,
-		IDTokenSigningAlgValues:                    cfg.IDTokenSigningAlgValues,
-		IDTokenEncryptionAlgValues:                 cfg.IDTokenEncryptionAlgValues,
-		IDTokenEncryptionEncValues:                 cfg.IDTokenEncryptionEncValues,
-		UserInfoSigningAlgValues:                   cfg.UserInfoSigningAlgValues,
-		UserInfoEncryptionAlgValues:                cfg.UserInfoEncryptionAlgValues,
-		UserInfoEncryptionEncValues:                cfg.UserInfoEncryptionEncValues,
-		ReqObjSigningAlgValues:                     cfg.ReqObjSigningAlgValues,
-		ReqObjEncryptionAlgValues:                  cfg.ReqObjEncryptionAlgValues,
-		ReqObjEncryptionEncValues:                  cfg.ReqObjEncryptionEncValues,
-		TokenEndpointAuthMethodsSupported:          cfg.TokenEndpointAuthMethodsSupported,
-		TokenEndpointAuthSigningAlgValuesSupported: cfg.TokenEndpointAuthSigningAlgValuesSupported,
-		DisplayValuesSupported:                     cfg.DisplayValuesSupported,
-		ClaimTypesSupported:                        cfg.ClaimTypesSupported,
-		ClaimsSupported:                            cfg.ClaimsSupported,
-		ServiceDocs:                                uriToString(cfg.ServiceDocs),
-		ClaimsLocalsSupported:                      cfg.ClaimsLocalsSupported,
-		UILocalsSupported:                          cfg.UILocalsSupported,
-		ClaimsParameterSupported:                   cfg.ClaimsParameterSupported,
-		RequestParameterSupported:                  cfg.RequestParameterSupported,
-		RequestURIParamaterSupported:               cfg.RequestURIParamaterSupported,
-		RequireRequestURIRegistration:              cfg.RequireRequestURIRegistration,
-		Policy:         uriToString(cfg.Policy),
-		TermsOfService: uriToString(cfg.TermsOfService),
-	}
-}
-
-func (e encodableProviderConfig) toStruct() (ProviderConfig, error) {
-	p := stickyErrParser{}
-	conf := ProviderConfig{
-		Issuer:                                     p.parseURI(e.Issuer, "issuer"),
-		AuthEndpoint:                               p.parseURI(e.AuthEndpoint, "authorization_endpoint"),
-		TokenEndpoint:                              p.parseURI(e.TokenEndpoint, "token_endpoint"),
-		UserInfoEndpoint:                           p.parseURI(e.UserInfoEndpoint, "userinfo_endpoint"),
-		KeysEndpoint:                               p.parseURI(e.KeysEndpoint, "jwks_uri"),
-		RegistrationEndpoint:                       p.parseURI(e.RegistrationEndpoint, "registration_endpoint"),
-		EndSessionEndpoint:                         p.parseURI(e.EndSessionEndpoint, "end_session_endpoint"),
-		CheckSessionIFrame:                         p.parseURI(e.CheckSessionIFrame, "check_session_iframe"),
-		ScopesSupported:                            e.ScopesSupported,
-		ResponseTypesSupported:                     e.ResponseTypesSupported,
-		ResponseModesSupported:                     e.ResponseModesSupported,
-		GrantTypesSupported:                        e.GrantTypesSupported,
-		ACRValuesSupported:                         e.ACRValuesSupported,
-		SubjectTypesSupported:                      e.SubjectTypesSupported,
-		IDTokenSigningAlgValues:                    e.IDTokenSigningAlgValues,
-		IDTokenEncryptionAlgValues:                 e.IDTokenEncryptionAlgValues,
-		IDTokenEncryptionEncValues:                 e.IDTokenEncryptionEncValues,
-		UserInfoSigningAlgValues:                   e.UserInfoSigningAlgValues,
-		UserInfoEncryptionAlgValues:                e.UserInfoEncryptionAlgValues,
-		UserInfoEncryptionEncValues:                e.UserInfoEncryptionEncValues,
-		ReqObjSigningAlgValues:                     e.ReqObjSigningAlgValues,
-		ReqObjEncryptionAlgValues:                  e.ReqObjEncryptionAlgValues,
-		ReqObjEncryptionEncValues:                  e.ReqObjEncryptionEncValues,
-		TokenEndpointAuthMethodsSupported:          e.TokenEndpointAuthMethodsSupported,
-		TokenEndpointAuthSigningAlgValuesSupported: e.TokenEndpointAuthSigningAlgValuesSupported,
-		DisplayValuesSupported:                     e.DisplayValuesSupported,
-		ClaimTypesSupported:                        e.ClaimTypesSupported,
-		ClaimsSupported:                            e.ClaimsSupported,
-		ServiceDocs:                                p.parseURI(e.ServiceDocs, "service_documentation"),
-		ClaimsLocalsSupported:                      e.ClaimsLocalsSupported,
-		UILocalsSupported:                          e.UILocalsSupported,
-		ClaimsParameterSupported:                   e.ClaimsParameterSupported,
-		RequestParameterSupported:                  e.RequestParameterSupported,
-		RequestURIParamaterSupported:               e.RequestURIParamaterSupported,
-		RequireRequestURIRegistration:              e.RequireRequestURIRegistration,
-		Policy:         p.parseURI(e.Policy, "op_policy-uri"),
-		TermsOfService: p.parseURI(e.TermsOfService, "op_tos_uri"),
-	}
-	if p.firstErr != nil {
-		return ProviderConfig{}, p.firstErr
-	}
-	return conf, nil
-}
-
-// Empty returns if a ProviderConfig holds no information.
-//
-// This case generally indicates a ProviderConfigGetter has experienced an error
-// and has nothing to report.
-func (p ProviderConfig) Empty() bool {
-	return p.Issuer == nil
-}
-
-func contains(sli []string, ele string) bool {
-	for _, s := range sli {
-		if s == ele {
-			return true
-		}
-	}
-	return false
-}
-
-// Valid determines if a ProviderConfig conforms with the OIDC specification.
-// If Valid returns successfully it guarantees required field are non-nil and
-// URLs are well formed.
-//
-// Valid is called by UnmarshalJSON.
-//
-// NOTE(ericchiang): For development purposes Valid does not mandate 'https' for
-// URLs fields where the OIDC spec requires it. This may change in future releases
-// of this package. See: https://github.com/coreos/go-oidc/issues/34
-func (p ProviderConfig) Valid() error {
-	grantTypes := p.GrantTypesSupported
-	if len(grantTypes) == 0 {
-		grantTypes = DefaultGrantTypesSupported
-	}
-	implicitOnly := true
-	for _, grantType := range grantTypes {
-		if grantType != oauth2.GrantTypeImplicit {
-			implicitOnly = false
-			break
-		}
-	}
-
-	if len(p.SubjectTypesSupported) == 0 {
-		return errors.New("missing required field subject_types_supported")
-	}
-	if len(p.IDTokenSigningAlgValues) == 0 {
-		return errors.New("missing required field id_token_signing_alg_values_supported")
-	}
-
-	if len(p.ScopesSupported) != 0 && !contains(p.ScopesSupported, "openid") {
-		return errors.New("scoped_supported must be unspecified or include 'openid'")
-	}
-
-	if !contains(p.IDTokenSigningAlgValues, "RS256") {
-		return errors.New("id_token_signing_alg_values_supported must include 'RS256'")
-	}
-	if contains(p.TokenEndpointAuthMethodsSupported, "none") {
-		return errors.New("token_endpoint_auth_signing_alg_values_supported cannot include 'none'")
-	}
-
-	uris := []struct {
-		val      *url.URL
-		name     string
-		required bool
-	}{
-		{p.Issuer, "issuer", true},
-		{p.AuthEndpoint, "authorization_endpoint", true},
-		{p.TokenEndpoint, "token_endpoint", !implicitOnly},
-		{p.UserInfoEndpoint, "userinfo_endpoint", false},
-		{p.KeysEndpoint, "jwks_uri", true},
-		{p.RegistrationEndpoint, "registration_endpoint", false},
-		{p.EndSessionEndpoint, "end_session_endpoint", false},
-		{p.CheckSessionIFrame, "check_session_iframe", false},
-		{p.ServiceDocs, "service_documentation", false},
-		{p.Policy, "op_policy_uri", false},
-		{p.TermsOfService, "op_tos_uri", false},
-	}
-
-	for _, uri := range uris {
-		if uri.val == nil {
-			if !uri.required {
-				continue
-			}
-			return fmt.Errorf("empty value for required uri field %s", uri.name)
-		}
-		if uri.val.Host == "" {
-			return fmt.Errorf("no host for uri field %s", uri.name)
-		}
-		if uri.val.Scheme != "http" && uri.val.Scheme != "https" {
-			return fmt.Errorf("uri field %s schemeis not http or https", uri.name)
-		}
-	}
-	return nil
-}
-
-// Supports determines if provider supports a client given their respective metadata.
-func (p ProviderConfig) Supports(c ClientMetadata) error {
-	if err := p.Valid(); err != nil {
-		return fmt.Errorf("invalid provider config: %v", err)
-	}
-	if err := c.Valid(); err != nil {
-		return fmt.Errorf("invalid client config: %v", err)
-	}
-
-	// Fill default values for omitted fields
-	c = c.Defaults()
-	p = p.Defaults()
-
-	// Do the supported values list the requested one?
-	supports := []struct {
-		supported []string
-		requested string
-		name      string
-	}{
-		{p.IDTokenSigningAlgValues, c.IDTokenResponseOptions.SigningAlg, "id_token_signed_response_alg"},
-		{p.IDTokenEncryptionAlgValues, c.IDTokenResponseOptions.EncryptionAlg, "id_token_encryption_response_alg"},
-		{p.IDTokenEncryptionEncValues, c.IDTokenResponseOptions.EncryptionEnc, "id_token_encryption_response_enc"},
-		{p.UserInfoSigningAlgValues, c.UserInfoResponseOptions.SigningAlg, "userinfo_signed_response_alg"},
-		{p.UserInfoEncryptionAlgValues, c.UserInfoResponseOptions.EncryptionAlg, "userinfo_encryption_response_alg"},
-		{p.UserInfoEncryptionEncValues, c.UserInfoResponseOptions.EncryptionEnc, "userinfo_encryption_response_enc"},
-		{p.ReqObjSigningAlgValues, c.RequestObjectOptions.SigningAlg, "request_object_signing_alg"},
-		{p.ReqObjEncryptionAlgValues, c.RequestObjectOptions.EncryptionAlg, "request_object_encryption_alg"},
-		{p.ReqObjEncryptionEncValues, c.RequestObjectOptions.EncryptionEnc, "request_object_encryption_enc"},
-	}
-	for _, field := range supports {
-		if field.requested == "" {
-			continue
-		}
-		if !contains(field.supported, field.requested) {
-			return fmt.Errorf("provider does not support requested value for field %s", field.name)
-		}
-	}
-
-	stringsEqual := func(s1, s2 string) bool { return s1 == s2 }
-
-	// For lists, are the list of requested values a subset of the supported ones?
-	supportsAll := []struct {
-		supported []string
-		requested []string
-		name      string
-		// OAuth2.0 response_type can be space separated lists where order doesn't matter.
-		// For example "id_token token" is the same as "token id_token"
-		// Support a custom compare method.
-		comp func(s1, s2 string) bool
-	}{
-		{p.GrantTypesSupported, c.GrantTypes, "grant_types", stringsEqual},
-		{p.ResponseTypesSupported, c.ResponseTypes, "response_type", oauth2.ResponseTypesEqual},
-	}
-	for _, field := range supportsAll {
-	requestLoop:
-		for _, req := range field.requested {
-			for _, sup := range field.supported {
-				if field.comp(req, sup) {
-					continue requestLoop
-				}
-			}
-			return fmt.Errorf("provider does not support requested value for field %s", field.name)
-		}
-	}
-
-	// TODO(ericchiang): Are there more checks we feel comfortable with begin strict about?
-
-	return nil
-}
-
-func (p ProviderConfig) SupportsGrantType(grantType string) bool {
-	var supported []string
-	if len(p.GrantTypesSupported) == 0 {
-		supported = DefaultGrantTypesSupported
-	} else {
-		supported = p.GrantTypesSupported
-	}
-
-	for _, t := range supported {
-		if t == grantType {
-			return true
-		}
-	}
-	return false
-}
-
-type ProviderConfigGetter interface {
-	Get() (ProviderConfig, error)
-}
-
-type ProviderConfigSetter interface {
-	Set(ProviderConfig) error
-}
-
-type ProviderConfigSyncer struct {
-	from  ProviderConfigGetter
-	to    ProviderConfigSetter
-	clock clockwork.Clock
-
-	initialSyncDone bool
-	initialSyncWait sync.WaitGroup
-}
-
-func NewProviderConfigSyncer(from ProviderConfigGetter, to ProviderConfigSetter) *ProviderConfigSyncer {
-	return &ProviderConfigSyncer{
-		from:  from,
-		to:    to,
-		clock: clockwork.NewRealClock(),
-	}
-}
-
-func (s *ProviderConfigSyncer) Run() chan struct{} {
-	stop := make(chan struct{})
-
-	var next pcsStepper
-	next = &pcsStepNext{aft: time.Duration(0)}
-
-	s.initialSyncWait.Add(1)
-	go func() {
-		for {
-			select {
-			case <-s.clock.After(next.after()):
-				next = next.step(s.sync)
-			case <-stop:
-				return
-			}
-		}
-	}()
-
-	return stop
-}
-
-func (s *ProviderConfigSyncer) WaitUntilInitialSync() {
-	s.initialSyncWait.Wait()
-}
-
-func (s *ProviderConfigSyncer) sync() (time.Duration, error) {
-	cfg, err := s.from.Get()
-	if err != nil {
-		return 0, err
-	}
-
-	if err = s.to.Set(cfg); err != nil {
-		return 0, fmt.Errorf("error setting provider config: %v", err)
-	}
-
-	if !s.initialSyncDone {
-		s.initialSyncWait.Done()
-		s.initialSyncDone = true
-	}
-
-	return nextSyncAfter(cfg.ExpiresAt, s.clock), nil
-}
-
-type pcsStepFunc func() (time.Duration, error)
-
-type pcsStepper interface {
-	after() time.Duration
-	step(pcsStepFunc) pcsStepper
-}
-
-type pcsStepNext struct {
-	aft time.Duration
-}
-
-func (n *pcsStepNext) after() time.Duration {
-	return n.aft
-}
-
-func (n *pcsStepNext) step(fn pcsStepFunc) (next pcsStepper) {
-	ttl, err := fn()
-	if err == nil {
-		next = &pcsStepNext{aft: ttl}
-	} else {
-		next = &pcsStepRetry{aft: time.Second}
-		log.Printf("go-oidc: provider config sync falied, retyring in %v: %v", next.after(), err)
-	}
-	return
-}
-
-type pcsStepRetry struct {
-	aft time.Duration
-}
-
-func (r *pcsStepRetry) after() time.Duration {
-	return r.aft
-}
-
-func (r *pcsStepRetry) step(fn pcsStepFunc) (next pcsStepper) {
-	ttl, err := fn()
-	if err == nil {
-		next = &pcsStepNext{aft: ttl}
-	} else {
-		next = &pcsStepRetry{aft: timeutil.ExpBackoff(r.aft, time.Minute)}
-		log.Printf("go-oidc: provider config sync falied, retyring in %v: %v", next.after(), err)
-	}
-	return
-}
-
-func nextSyncAfter(exp time.Time, clock clockwork.Clock) time.Duration {
-	if exp.IsZero() {
-		return MaximumProviderConfigSyncInterval
-	}
-
-	t := exp.Sub(clock.Now()) / 2
-	if t > MaximumProviderConfigSyncInterval {
-		t = MaximumProviderConfigSyncInterval
-	} else if t < minimumProviderConfigSyncInterval {
-		t = minimumProviderConfigSyncInterval
-	}
-
-	return t
-}
-
-type httpProviderConfigGetter struct {
-	hc        phttp.Client
-	issuerURL string
-	clock     clockwork.Clock
-}
-
-func NewHTTPProviderConfigGetter(hc phttp.Client, issuerURL string) *httpProviderConfigGetter {
-	return &httpProviderConfigGetter{
-		hc:        hc,
-		issuerURL: issuerURL,
-		clock:     clockwork.NewRealClock(),
-	}
-}
-
-func (r *httpProviderConfigGetter) Get() (cfg ProviderConfig, err error) {
-	// If the Issuer value contains a path component, any terminating / MUST be removed before
-	// appending /.well-known/openid-configuration.
-	// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest
-	discoveryURL := strings.TrimSuffix(r.issuerURL, "/") + discoveryConfigPath
-	req, err := http.NewRequest("GET", discoveryURL, nil)
-	if err != nil {
-		return
-	}
-
-	resp, err := r.hc.Do(req)
-	if err != nil {
-		return
-	}
-	defer resp.Body.Close()
-
-	if err = json.NewDecoder(resp.Body).Decode(&cfg); err != nil {
-		return
-	}
-
-	var ttl time.Duration
-	var ok bool
-	ttl, ok, err = phttp.Cacheable(resp.Header)
-	if err != nil {
-		return
-	} else if ok {
-		cfg.ExpiresAt = r.clock.Now().UTC().Add(ttl)
-	}
-
-	// The issuer value returned MUST be identical to the Issuer URL that was directly used to retrieve the configuration information.
-	// http://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation
-	if !urlEqual(cfg.Issuer.String(), r.issuerURL) {
-		err = fmt.Errorf(`"issuer" in config (%v) does not match provided issuer URL (%v)`, cfg.Issuer, r.issuerURL)
-		return
-	}
-
-	return
-}
-
-func FetchProviderConfig(hc phttp.Client, issuerURL string) (ProviderConfig, error) {
-	if hc == nil {
-		hc = http.DefaultClient
-	}
-
-	g := NewHTTPProviderConfigGetter(hc, issuerURL)
-	return g.Get()
-}
-
-func WaitForProviderConfig(hc phttp.Client, issuerURL string) (pcfg ProviderConfig) {
-	return waitForProviderConfig(hc, issuerURL, clockwork.NewRealClock())
-}
-
-func waitForProviderConfig(hc phttp.Client, issuerURL string, clock clockwork.Clock) (pcfg ProviderConfig) {
-	var sleep time.Duration
-	var err error
-	for {
-		pcfg, err = FetchProviderConfig(hc, issuerURL)
-		if err == nil {
-			break
-		}
-
-		sleep = timeutil.ExpBackoff(sleep, time.Minute)
-		fmt.Printf("Failed fetching provider config, trying again in %v: %v\n", sleep, err)
-		time.Sleep(sleep)
-	}
-
-	return
-}

vendor/github.com/coreos/go-oidc/oidc/transport.go

@@ -1,88 +0,0 @@
-package oidc
-
-import (
-	"fmt"
-	"net/http"
-	"sync"
-
-	phttp "github.com/coreos/go-oidc/http"
-	"github.com/coreos/go-oidc/jose"
-)
-
-type TokenRefresher interface {
-	// Verify checks if the provided token is currently valid or not.
-	Verify(jose.JWT) error
-
-	// Refresh attempts to authenticate and retrieve a new token.
-	Refresh() (jose.JWT, error)
-}
-
-type ClientCredsTokenRefresher struct {
-	Issuer     string
-	OIDCClient *Client
-}
-
-func (c *ClientCredsTokenRefresher) Verify(jwt jose.JWT) (err error) {
-	_, err = VerifyClientClaims(jwt, c.Issuer)
-	return
-}
-
-func (c *ClientCredsTokenRefresher) Refresh() (jwt jose.JWT, err error) {
-	if err = c.OIDCClient.Healthy(); err != nil {
-		err = fmt.Errorf("unable to authenticate, unhealthy OIDC client: %v", err)
-		return
-	}
-
-	jwt, err = c.OIDCClient.ClientCredsToken([]string{"openid"})
-	if err != nil {
-		err = fmt.Errorf("unable to verify auth code with issuer: %v", err)
-		return
-	}
-
-	return
-}
-
-type AuthenticatedTransport struct {
-	TokenRefresher
-	http.RoundTripper
-
-	mu  sync.Mutex
-	jwt jose.JWT
-}
-
-func (t *AuthenticatedTransport) verifiedJWT() (jose.JWT, error) {
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	if t.TokenRefresher.Verify(t.jwt) == nil {
-		return t.jwt, nil
-	}
-
-	jwt, err := t.TokenRefresher.Refresh()
-	if err != nil {
-		return jose.JWT{}, fmt.Errorf("unable to acquire valid JWT: %v", err)
-	}
-
-	t.jwt = jwt
-	return t.jwt, nil
-}
-
-// SetJWT sets the JWT held by the Transport.
-// This is useful for cases in which you want to set an initial JWT.
-func (t *AuthenticatedTransport) SetJWT(jwt jose.JWT) {
-	t.mu.Lock()
-	defer t.mu.Unlock()
-
-	t.jwt = jwt
-}
-
-func (t *AuthenticatedTransport) RoundTrip(r *http.Request) (*http.Response, error) {
-	jwt, err := t.verifiedJWT()
-	if err != nil {
-		return nil, err
-	}
-
-	req := phttp.CopyRequest(r)
-	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", jwt.Encode()))
-	return t.RoundTripper.RoundTrip(req)
-}

vendor/github.com/coreos/go-oidc/oidc/util.go

@@ -1,109 +0,0 @@
-package oidc
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-
-	"github.com/coreos/go-oidc/jose"
-)
-
-// RequestTokenExtractor funcs extract a raw encoded token from a request.
-type RequestTokenExtractor func(r *http.Request) (string, error)
-
-// ExtractBearerToken is a RequestTokenExtractor which extracts a bearer token from a request's
-// Authorization header.
-func ExtractBearerToken(r *http.Request) (string, error) {
-	ah := r.Header.Get("Authorization")
-	if ah == "" {
-		return "", errors.New("missing Authorization header")
-	}
-
-	if len(ah) <= 6 || strings.ToUpper(ah[0:6]) != "BEARER" {
-		return "", errors.New("should be a bearer token")
-	}
-
-	val := ah[7:]
-	if len(val) == 0 {
-		return "", errors.New("bearer token is empty")
-	}
-
-	return val, nil
-}
-
-// CookieTokenExtractor returns a RequestTokenExtractor which extracts a token from the named cookie in a request.
-func CookieTokenExtractor(cookieName string) RequestTokenExtractor {
-	return func(r *http.Request) (string, error) {
-		ck, err := r.Cookie(cookieName)
-		if err != nil {
-			return "", fmt.Errorf("token cookie not found in request: %v", err)
-		}
-
-		if ck.Value == "" {
-			return "", errors.New("token cookie found but is empty")
-		}
-
-		return ck.Value, nil
-	}
-}
-
-func NewClaims(iss, sub string, aud interface{}, iat, exp time.Time) jose.Claims {
-	return jose.Claims{
-		// required
-		"iss": iss,
-		"sub": sub,
-		"aud": aud,
-		"iat": iat.Unix(),
-		"exp": exp.Unix(),
-	}
-}
-
-func GenClientID(hostport string) (string, error) {
-	b, err := randBytes(32)
-	if err != nil {
-		return "", err
-	}
-
-	var host string
-	if strings.Contains(hostport, ":") {
-		host, _, err = net.SplitHostPort(hostport)
-		if err != nil {
-			return "", err
-		}
-	} else {
-		host = hostport
-	}
-
-	return fmt.Sprintf("%s@%s", base64.URLEncoding.EncodeToString(b), host), nil
-}
-
-func randBytes(n int) ([]byte, error) {
-	b := make([]byte, n)
-	got, err := rand.Read(b)
-	if err != nil {
-		return nil, err
-	} else if n != got {
-		return nil, errors.New("unable to generate enough random data")
-	}
-	return b, nil
-}
-
-// urlEqual checks two urls for equality using only the host and path portions.
-func urlEqual(url1, url2 string) bool {
-	u1, err := url.Parse(url1)
-	if err != nil {
-		return false
-	}
-	u2, err := url.Parse(url2)
-	if err != nil {
-		return false
-	}
-
-	return strings.ToLower(u1.Host+u1.Path) == strings.ToLower(u2.Host+u2.Path)
-}

vendor/github.com/coreos/go-oidc/oidc/verification.go

@@ -1,190 +0,0 @@
-package oidc
-
-import (
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/jonboulle/clockwork"
-
-	"github.com/coreos/go-oidc/jose"
-	"github.com/coreos/go-oidc/key"
-)
-
-func VerifySignature(jwt jose.JWT, keys []key.PublicKey) (bool, error) {
-	jwtBytes := []byte(jwt.Data())
-	for _, k := range keys {
-		v, err := k.Verifier()
-		if err != nil {
-			return false, err
-		}
-		if v.Verify(jwt.Signature, jwtBytes) == nil {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// containsString returns true if the given string(needle) is found
-// in the string array(haystack).
-func containsString(needle string, haystack []string) bool {
-	for _, v := range haystack {
-		if v == needle {
-			return true
-		}
-	}
-	return false
-}
-
-// Verify claims in accordance with OIDC spec
-// http://openid.net/specs/openid-connect-basic-1_0.html#IDTokenValidation
-func VerifyClaims(jwt jose.JWT, issuer, clientID string) error {
-	now := time.Now().UTC()
-
-	claims, err := jwt.Claims()
-	if err != nil {
-		return err
-	}
-
-	ident, err := IdentityFromClaims(claims)
-	if err != nil {
-		return err
-	}
-
-	if ident.ExpiresAt.Before(now) {
-		return errors.New("token is expired")
-	}
-
-	// iss REQUIRED. Issuer Identifier for the Issuer of the response.
-	// The iss value is a case sensitive URL using the https scheme that contains scheme,
-	// host, and optionally, port number and path components and no query or fragment components.
-	if iss, exists := claims["iss"].(string); exists {
-		if !urlEqual(iss, issuer) {
-			return fmt.Errorf("invalid claim value: 'iss'. expected=%s, found=%s.", issuer, iss)
-		}
-	} else {
-		return errors.New("missing claim: 'iss'")
-	}
-
-	// iat REQUIRED. Time at which the JWT was issued.
-	// Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z
-	// as measured in UTC until the date/time.
-	if _, exists := claims["iat"].(float64); !exists {
-		return errors.New("missing claim: 'iat'")
-	}
-
-	// aud REQUIRED. Audience(s) that this ID Token is intended for.
-	// It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value.
-	// It MAY also contain identifiers for other audiences. In the general case, the aud
-	// value is an array of case sensitive strings. In the common special case when there
-	// is one audience, the aud value MAY be a single case sensitive string.
-	if aud, ok, err := claims.StringClaim("aud"); err == nil && ok {
-		if aud != clientID {
-			return fmt.Errorf("invalid claims, 'aud' claim and 'client_id' do not match, aud=%s, client_id=%s", aud, clientID)
-		}
-	} else if aud, ok, err := claims.StringsClaim("aud"); err == nil && ok {
-		if !containsString(clientID, aud) {
-			return fmt.Errorf("invalid claims, cannot find 'client_id' in 'aud' claim, aud=%v, client_id=%s", aud, clientID)
-		}
-	} else {
-		return errors.New("invalid claim value: 'aud' is required, and should be either string or string array")
-	}
-
-	return nil
-}
-
-// VerifyClientClaims verifies all the required claims are valid for a "client credentials" JWT.
-// Returns the client ID if valid, or an error if invalid.
-func VerifyClientClaims(jwt jose.JWT, issuer string) (string, error) {
-	claims, err := jwt.Claims()
-	if err != nil {
-		return "", fmt.Errorf("failed to parse JWT claims: %v", err)
-	}
-
-	iss, ok, err := claims.StringClaim("iss")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'iss' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'iss' claim")
-	} else if !urlEqual(iss, issuer) {
-		return "", fmt.Errorf("'iss' claim does not match expected issuer, iss=%s", iss)
-	}
-
-	sub, ok, err := claims.StringClaim("sub")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'sub' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'sub' claim")
-	}
-
-	if aud, ok, err := claims.StringClaim("aud"); err == nil && ok {
-		if aud != sub {
-			return "", fmt.Errorf("invalid claims, 'aud' claim and 'sub' claim do not match, aud=%s, sub=%s", aud, sub)
-		}
-	} else if aud, ok, err := claims.StringsClaim("aud"); err == nil && ok {
-		if !containsString(sub, aud) {
-			return "", fmt.Errorf("invalid claims, cannot find 'sud' in 'aud' claim, aud=%v, sub=%s", aud, sub)
-		}
-	} else {
-		return "", errors.New("invalid claim value: 'aud' is required, and should be either string or string array")
-	}
-
-	now := time.Now().UTC()
-	exp, ok, err := claims.TimeClaim("exp")
-	if err != nil {
-		return "", fmt.Errorf("failed to parse 'exp' claim: %v", err)
-	} else if !ok {
-		return "", errors.New("missing required 'exp' claim")
-	} else if exp.Before(now) {
-		return "", fmt.Errorf("token already expired at: %v", exp)
-	}
-
-	return sub, nil
-}
-
-type JWTVerifier struct {
-	issuer   string
-	clientID string
-	syncFunc func() error
-	keysFunc func() []key.PublicKey
-	clock    clockwork.Clock
-}
-
-func NewJWTVerifier(issuer, clientID string, syncFunc func() error, keysFunc func() []key.PublicKey) JWTVerifier {
-	return JWTVerifier{
-		issuer:   issuer,
-		clientID: clientID,
-		syncFunc: syncFunc,
-		keysFunc: keysFunc,
-		clock:    clockwork.NewRealClock(),
-	}
-}
-
-func (v *JWTVerifier) Verify(jwt jose.JWT) error {
-	// Verify claims before verifying the signature. This is an optimization to throw out
-	// tokens we know are invalid without undergoing an expensive signature check and
-	// possibly a re-sync event.
-	if err := VerifyClaims(jwt, v.issuer, v.clientID); err != nil {
-		return fmt.Errorf("oidc: JWT claims invalid: %v", err)
-	}
-
-	ok, err := VerifySignature(jwt, v.keysFunc())
-	if err != nil {
-		return fmt.Errorf("oidc: JWT signature verification failed: %v", err)
-	} else if ok {
-		return nil
-	}
-
-	if err = v.syncFunc(); err != nil {
-		return fmt.Errorf("oidc: failed syncing KeySet: %v", err)
-	}
-
-	ok, err = VerifySignature(jwt, v.keysFunc())
-	if err != nil {
-		return fmt.Errorf("oidc: JWT signature verification failed: %v", err)
-	} else if !ok {
-		return errors.New("oidc: unable to verify JWT signature: no matching keys")
-	}
-
-	return nil
-}

vendor/github.com/coreos/pkg/LICENSE

@@ -1,202 +0,0 @@
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-

vendor/github.com/coreos/pkg/NOTICE

@@ -1,5 +0,0 @@
-CoreOS Project
-Copyright 2014 CoreOS, Inc
-
-This product includes software developed at CoreOS, Inc.
-(http://www.coreos.com/).

vendor/github.com/coreos/pkg/health/README.md

@@ -1,11 +0,0 @@
-health
-====
-
-A simple framework for implementing an HTTP health check endpoint on servers.
-
-Users implement their `health.Checkable` types, and create a `health.Checker`, from which they can get an `http.HandlerFunc` using `health.Checker.MakeHealthHandlerFunc`.
-
-### Documentation
-
-For more details, visit the docs on [gopkgdoc](http://godoc.org/github.com/coreos/pkg/health)
-

vendor/github.com/coreos/pkg/health/health.go

@@ -1,127 +0,0 @@
-package health
-
-import (
-	"expvar"
-	"fmt"
-	"log"
-	"net/http"
-
-	"github.com/coreos/pkg/httputil"
-)
-
-// Checkables should return nil when the thing they are checking is healthy, and an error otherwise.
-type Checkable interface {
-	Healthy() error
-}
-
-// Checker provides a way to make an endpoint which can be probed for system health.
-type Checker struct {
-	// Checks are the Checkables to be checked when probing.
-	Checks []Checkable
-
-	// Unhealthyhandler is called when one or more of the checks are unhealthy.
-	// If not provided DefaultUnhealthyHandler is called.
-	UnhealthyHandler UnhealthyHandler
-
-	// HealthyHandler is called when all checks are healthy.
-	// If not provided, DefaultHealthyHandler is called.
-	HealthyHandler http.HandlerFunc
-}
-
-func (c Checker) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	unhealthyHandler := c.UnhealthyHandler
-	if unhealthyHandler == nil {
-		unhealthyHandler = DefaultUnhealthyHandler
-	}
-
-	successHandler := c.HealthyHandler
-	if successHandler == nil {
-		successHandler = DefaultHealthyHandler
-	}
-
-	if r.Method != "GET" {
-		w.Header().Set("Allow", "GET")
-		w.WriteHeader(http.StatusMethodNotAllowed)
-		return
-	}
-
-	if err := Check(c.Checks); err != nil {
-		unhealthyHandler(w, r, err)
-		return
-	}
-
-	successHandler(w, r)
-}
-
-type UnhealthyHandler func(w http.ResponseWriter, r *http.Request, err error)
-
-type StatusResponse struct {
-	Status  string                 `json:"status"`
-	Details *StatusResponseDetails `json:"details,omitempty"`
-}
-
-type StatusResponseDetails struct {
-	Code    int    `json:"code,omitempty"`
-	Message string `json:"message,omitempty"`
-}
-
-func Check(checks []Checkable) (err error) {
-	errs := []error{}
-	for _, c := range checks {
-		if e := c.Healthy(); e != nil {
-			errs = append(errs, e)
-		}
-	}
-
-	switch len(errs) {
-	case 0:
-		err = nil
-	case 1:
-		err = errs[0]
-	default:
-		err = fmt.Errorf("multiple health check failure: %v", errs)
-	}
-
-	return
-}
-
-func DefaultHealthyHandler(w http.ResponseWriter, r *http.Request) {
-	err := httputil.WriteJSONResponse(w, http.StatusOK, StatusResponse{
-		Status: "ok",
-	})
-	if err != nil {
-		// TODO(bobbyrullo): replace with logging from new logging pkg,
-		// once it lands.
-		log.Printf("Failed to write JSON response: %v", err)
-	}
-}
-
-func DefaultUnhealthyHandler(w http.ResponseWriter, r *http.Request, err error) {
-	writeErr := httputil.WriteJSONResponse(w, http.StatusInternalServerError, StatusResponse{
-		Status: "error",
-		Details: &StatusResponseDetails{
-			Code:    http.StatusInternalServerError,
-			Message: err.Error(),
-		},
-	})
-	if writeErr != nil {
-		// TODO(bobbyrullo): replace with logging from new logging pkg,
-		// once it lands.
-		log.Printf("Failed to write JSON response: %v", err)
-	}
-}
-
-// ExpvarHandler is copied from https://golang.org/src/expvar/expvar.go, where it's sadly unexported.
-func ExpvarHandler(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	fmt.Fprintf(w, "{\n")
-	first := true
-	expvar.Do(func(kv expvar.KeyValue) {
-		if !first {
-			fmt.Fprintf(w, ",\n")
-		}
-		first = false
-		fmt.Fprintf(w, "%q: %s", kv.Key, kv.Value)
-	})
-	fmt.Fprintf(w, "\n}\n")
-}

vendor/github.com/coreos/pkg/httputil/README.md

@@ -1,13 +0,0 @@
-httputil
-====
-
-Common code for dealing with HTTP.
-
-Includes:
-
-* Code for returning JSON responses.
-
-### Documentation
-
-Visit the docs on [gopkgdoc](http://godoc.org/github.com/coreos/pkg/httputil)
-

vendor/github.com/coreos/pkg/httputil/cookie.go

@@ -1,21 +0,0 @@
-package httputil
-
-import (
-	"net/http"
-	"time"
-)
-
-// DeleteCookies effectively deletes all named cookies
-// by wiping all data and setting to expire immediately.
-func DeleteCookies(w http.ResponseWriter, cookieNames ...string) {
-	for _, n := range cookieNames {
-		c := &http.Cookie{
-			Name:    n,
-			Value:   "",
-			Path:    "/",
-			MaxAge:  -1,
-			Expires: time.Time{},
-		}
-		http.SetCookie(w, c)
-	}
-}

vendor/github.com/coreos/pkg/httputil/json.go

@@ -1,27 +0,0 @@
-package httputil
-
-import (
-	"encoding/json"
-	"net/http"
-)
-
-const (
-	JSONContentType = "application/json"
-)
-
-func WriteJSONResponse(w http.ResponseWriter, code int, resp interface{}) error {
-	enc, err := json.Marshal(resp)
-	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		return err
-	}
-
-	w.Header().Set("Content-Type", JSONContentType)
-	w.WriteHeader(code)
-
-	_, err = w.Write(enc)
-	if err != nil {
-		return err
-	}
-	return nil
-}

vendor/github.com/coreos/pkg/timeutil/backoff.go

@@ -1,15 +0,0 @@
-package timeutil
-
-import (
-	"time"
-)
-
-func ExpBackoff(prev, max time.Duration) time.Duration {
-	if prev == 0 {
-		return time.Second
-	}
-	if prev > max/2 {
-		return max
-	}
-	return 2 * prev
-}

vendor/github.com/gogo/protobuf/LICENSE

@@ -1,7 +1,7 @@
-Extensions for Protocol Buffers to create more go like structures.
+Protocol Buffers for Go with Gadgets
 
-Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-http://github.com/gogo/protobuf/gogoproto
+Copyright (c) 2013, The GoGo Authors. All rights reserved.
+http://github.com/gogo/protobuf
 
 Go support for Protocol Buffers - Google's data interchange format
 

vendor/github.com/gogo/protobuf/proto/Makefile

@@ -39,5 +39,5 @@ test: install generate-test-pbs
 generate-test-pbs:
 	make install
 	make -C testdata
-	protoc-min-version --version="3.0.0" --proto_path=.:../../../../ --gogo_out=. proto3_proto/proto3.proto
+	protoc-min-version --version="3.0.0" --proto_path=.:../../../../:../protobuf --gogo_out=Mtestdata/test.proto=github.com/gogo/protobuf/proto/testdata,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types:. proto3_proto/proto3.proto
 	make

vendor/github.com/gogo/protobuf/proto/clone.go

@@ -84,14 +84,20 @@ func mergeStruct(out, in reflect.Value) {
 		mergeAny(out.Field(i), in.Field(i), false, sprop.Prop[i])
 	}
 
-	if emIn, ok := in.Addr().Interface().(extensionsMap); ok {
-		emOut := out.Addr().Interface().(extensionsMap)
-		mergeExtension(emOut.ExtensionMap(), emIn.ExtensionMap())
-	} else if emIn, ok := in.Addr().Interface().(extensionsBytes); ok {
+	if emIn, ok := in.Addr().Interface().(extensionsBytes); ok {
 		emOut := out.Addr().Interface().(extensionsBytes)
 		bIn := emIn.GetExtensions()
 		bOut := emOut.GetExtensions()
 		*bOut = append(*bOut, *bIn...)
+	} else if emIn, ok := extendable(in.Addr().Interface()); ok {
+		emOut, _ := extendable(out.Addr().Interface())
+		mIn, muIn := emIn.extensionsRead()
+		if mIn != nil {
+			mOut := emOut.extensionsWrite()
+			muIn.Lock()
+			mergeExtension(mOut, mIn)
+			muIn.Unlock()
+		}
 	}
 
 	uf := in.FieldByName("XXX_unrecognized")

vendor/github.com/gogo/protobuf/proto/decode.go

@@ -61,7 +61,6 @@ var ErrInternalBadWireType = errors.New("proto: internal error: bad wiretype for
 // int32, int64, uint32, uint64, bool, and enum
 // protocol buffer types.
 func DecodeVarint(buf []byte) (x uint64, n int) {
-	// x, n already 0
 	for shift := uint(0); shift < 64; shift += 7 {
 		if n >= len(buf) {
 			return 0, 0
@@ -78,13 +77,7 @@ func DecodeVarint(buf []byte) (x uint64, n int) {
 	return 0, 0
 }
 
-// DecodeVarint reads a varint-encoded integer from the Buffer.
-// This is the format for the
-// int32, int64, uint32, uint64, bool, and enum
-// protocol buffer types.
-func (p *Buffer) DecodeVarint() (x uint64, err error) {
-	// x, err already 0
-
+func (p *Buffer) decodeVarintSlow() (x uint64, err error) {
 	i := p.index
 	l := len(p.buf)
 
@@ -107,6 +100,107 @@ func (p *Buffer) DecodeVarint() (x uint64, err error) {
 	return
 }
 
+// DecodeVarint reads a varint-encoded integer from the Buffer.
+// This is the format for the
+// int32, int64, uint32, uint64, bool, and enum
+// protocol buffer types.
+func (p *Buffer) DecodeVarint() (x uint64, err error) {
+	i := p.index
+	buf := p.buf
+
+	if i >= len(buf) {
+		return 0, io.ErrUnexpectedEOF
+	} else if buf[i] < 0x80 {
+		p.index++
+		return uint64(buf[i]), nil
+	} else if len(buf)-i < 10 {
+		return p.decodeVarintSlow()
+	}
+
+	var b uint64
+	// we already checked the first byte
+	x = uint64(buf[i]) - 0x80
+	i++
+
+	b = uint64(buf[i])
+	i++
+	x += b << 7
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 7
+
+	b = uint64(buf[i])
+	i++
+	x += b << 14
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 14
+
+	b = uint64(buf[i])
+	i++
+	x += b << 21
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 21
+
+	b = uint64(buf[i])
+	i++
+	x += b << 28
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 28
+
+	b = uint64(buf[i])
+	i++
+	x += b << 35
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 35
+
+	b = uint64(buf[i])
+	i++
+	x += b << 42
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 42
+
+	b = uint64(buf[i])
+	i++
+	x += b << 49
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 49
+
+	b = uint64(buf[i])
+	i++
+	x += b << 56
+	if b&0x80 == 0 {
+		goto done
+	}
+	x -= 0x80 << 56
+
+	b = uint64(buf[i])
+	i++
+	x += b << 63
+	if b&0x80 == 0 {
+		goto done
+	}
+	// x -= 0x80 << 63 // Always zero.
+
+	return 0, errOverflow
+
+done:
+	p.index = i
+	return x, nil
+}
+
 // DecodeFixed64 reads a 64-bit integer from the Buffer.
 // This is the format for the
 // fixed64, sfixed64, and double protocol buffer types.
@@ -340,6 +434,8 @@ func (p *Buffer) DecodeGroup(pb Message) error {
 // Buffer and places the decoded result in pb.  If the struct
 // underlying pb does not match the data in the buffer, the results can be
 // unpredictable.
+//
+// Unlike proto.Unmarshal, this does not reset pb before starting to unmarshal.
 func (p *Buffer) Unmarshal(pb Message) error {
 	// If the object can unmarshal itself, let it.
 	if u, ok := pb.(Unmarshaler); ok {
@@ -378,6 +474,11 @@ func (o *Buffer) unmarshalType(st reflect.Type, prop *StructProperties, is_group
 		wire := int(u & 0x7)
 		if wire == WireEndGroup {
 			if is_group {
+				if required > 0 {
+					// Not enough information to determine the exact field.
+					// (See below.)
+					return &RequiredNotSetError{"{Unknown}"}
+				}
 				return nil // input is satisfied
 			}
 			return fmt.Errorf("proto: %s: wiretype end group for non-group", st)
@@ -390,16 +491,20 @@ func (o *Buffer) unmarshalType(st reflect.Type, prop *StructProperties, is_group
 		if !ok {
 			// Maybe it's an extension?
 			if prop.extendable {
-				if e := structPointer_Interface(base, st).(extendableProto); isExtensionField(e, int32(tag)) {
-					if err = o.skip(st, tag, wire); err == nil {
-						if ee, eok := e.(extensionsMap); eok {
-							ext := ee.ExtensionMap()[int32(tag)] // may be missing
-							ext.enc = append(ext.enc, o.buf[oi:o.index]...)
-							ee.ExtensionMap()[int32(tag)] = ext
-						} else if ee, eok := e.(extensionsBytes); eok {
-							ext := ee.GetExtensions()
+				if e, eok := structPointer_Interface(base, st).(extensionsBytes); eok {
+					if isExtensionField(e, int32(tag)) {
+						if err = o.skip(st, tag, wire); err == nil {
+							ext := e.GetExtensions()
 							*ext = append(*ext, o.buf[oi:o.index]...)
 						}
+						continue
+					}
+				} else if e, _ := extendable(structPointer_Interface(base, st)); isExtensionField(e, int32(tag)) {
+					if err = o.skip(st, tag, wire); err == nil {
+						extmap := e.extensionsWrite()
+						ext := extmap[int32(tag)] // may be missing
+						ext.enc = append(ext.enc, o.buf[oi:o.index]...)
+						extmap[int32(tag)] = ext
 					}
 					continue
 				}

vendor/github.com/gogo/protobuf/proto/decode_gogo.go

@@ -1,5 +1,7 @@
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -96,7 +98,7 @@ func setPtrCustomType(base structPointer, f field, v interface{}) {
 	if v == nil {
 		return
 	}
-	structPointer_SetStructPointer(base, f, structPointer(reflect.ValueOf(v).Pointer()))
+	structPointer_SetStructPointer(base, f, toStructPointer(reflect.ValueOf(v)))
 }
 
 func setCustomType(base structPointer, f field, value interface{}) {
@@ -163,7 +165,8 @@ func (o *Buffer) dec_custom_slice_bytes(p *Properties, base structPointer) error
 	}
 	newBas := appendStructPointer(base, p.field, p.ctype)
 
-	setCustomType(newBas, 0, custom)
+	var zero field
+	setCustomType(newBas, zero, custom)
 
 	return nil
 }

vendor/github.com/gogo/protobuf/proto/duration.go

@@ -0,0 +1,100 @@
+// Go support for Protocol Buffers - Google's data interchange format
+//
+// Copyright 2016 The Go Authors.  All rights reserved.
+// https://github.com/golang/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package proto
+
+// This file implements conversions between google.protobuf.Duration
+// and time.Duration.
+
+import (
+	"errors"
+	"fmt"
+	"time"
+)
+
+const (
+	// Range of a Duration in seconds, as specified in
+	// google/protobuf/duration.proto. This is about 10,000 years in seconds.
+	maxSeconds = int64(10000 * 365.25 * 24 * 60 * 60)
+	minSeconds = -maxSeconds
+)
+
+// validateDuration determines whether the Duration is valid according to the
+// definition in google/protobuf/duration.proto. A valid Duration
+// may still be too large to fit into a time.Duration (the range of Duration
+// is about 10,000 years, and the range of time.Duration is about 290).
+func validateDuration(d *duration) error {
+	if d == nil {
+		return errors.New("duration: nil Duration")
+	}
+	if d.Seconds < minSeconds || d.Seconds > maxSeconds {
+		return fmt.Errorf("duration: %#v: seconds out of range", d)
+	}
+	if d.Nanos <= -1e9 || d.Nanos >= 1e9 {
+		return fmt.Errorf("duration: %#v: nanos out of range", d)
+	}
+	// Seconds and Nanos must have the same sign, unless d.Nanos is zero.
+	if (d.Seconds < 0 && d.Nanos > 0) || (d.Seconds > 0 && d.Nanos < 0) {
+		return fmt.Errorf("duration: %#v: seconds and nanos have different signs", d)
+	}
+	return nil
+}
+
+// DurationFromProto converts a Duration to a time.Duration. DurationFromProto
+// returns an error if the Duration is invalid or is too large to be
+// represented in a time.Duration.
+func durationFromProto(p *duration) (time.Duration, error) {
+	if err := validateDuration(p); err != nil {
+		return 0, err
+	}
+	d := time.Duration(p.Seconds) * time.Second
+	if int64(d/time.Second) != p.Seconds {
+		return 0, fmt.Errorf("duration: %#v is out of range for time.Duration", p)
+	}
+	if p.Nanos != 0 {
+		d += time.Duration(p.Nanos)
+		if (d < 0) != (p.Nanos < 0) {
+			return 0, fmt.Errorf("duration: %#v is out of range for time.Duration", p)
+		}
+	}
+	return d, nil
+}
+
+// DurationProto converts a time.Duration to a Duration.
+func durationProto(d time.Duration) *duration {
+	nanos := d.Nanoseconds()
+	secs := nanos / 1e9
+	nanos -= secs * 1e9
+	return &duration{
+		Seconds: secs,
+		Nanos:   int32(nanos),
+	}
+}

vendor/github.com/gogo/protobuf/proto/duration_gogo.go

@@ -0,0 +1,203 @@
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2016, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package proto
+
+import (
+	"reflect"
+	"time"
+)
+
+var durationType = reflect.TypeOf((*time.Duration)(nil)).Elem()
+
+type duration struct {
+	Seconds int64 `protobuf:"varint,1,opt,name=seconds,proto3" json:"seconds,omitempty"`
+	Nanos   int32 `protobuf:"varint,2,opt,name=nanos,proto3" json:"nanos,omitempty"`
+}
+
+func (m *duration) Reset()       { *m = duration{} }
+func (*duration) ProtoMessage()  {}
+func (*duration) String() string { return "duration<string>" }
+
+func init() {
+	RegisterType((*duration)(nil), "gogo.protobuf.proto.duration")
+}
+
+func (o *Buffer) decDuration() (time.Duration, error) {
+	b, err := o.DecodeRawBytes(true)
+	if err != nil {
+		return 0, err
+	}
+	dproto := &duration{}
+	if err := Unmarshal(b, dproto); err != nil {
+		return 0, err
+	}
+	return durationFromProto(dproto)
+}
+
+func (o *Buffer) dec_duration(p *Properties, base structPointer) error {
+	d, err := o.decDuration()
+	if err != nil {
+		return err
+	}
+	word64_Set(structPointer_Word64(base, p.field), o, uint64(d))
+	return nil
+}
+
+func (o *Buffer) dec_ref_duration(p *Properties, base structPointer) error {
+	d, err := o.decDuration()
+	if err != nil {
+		return err
+	}
+	word64Val_Set(structPointer_Word64Val(base, p.field), o, uint64(d))
+	return nil
+}
+
+func (o *Buffer) dec_slice_duration(p *Properties, base structPointer) error {
+	d, err := o.decDuration()
+	if err != nil {
+		return err
+	}
+	newBas := appendStructPointer(base, p.field, reflect.SliceOf(reflect.PtrTo(durationType)))
+	var zero field
+	setPtrCustomType(newBas, zero, &d)
+	return nil
+}
+
+func (o *Buffer) dec_slice_ref_duration(p *Properties, base structPointer) error {
+	d, err := o.decDuration()
+	if err != nil {
+		return err
+	}
+	structPointer_Word64Slice(base, p.field).Append(uint64(d))
+	return nil
+}
+
+func size_duration(p *Properties, base structPointer) (n int) {
+	structp := structPointer_GetStructPointer(base, p.field)
+	if structPointer_IsNil(structp) {
+		return 0
+	}
+	dur := structPointer_Interface(structp, durationType).(*time.Duration)
+	d := durationProto(*dur)
+	size := Size(d)
+	return size + sizeVarint(uint64(size)) + len(p.tagcode)
+}
+
+func (o *Buffer) enc_duration(p *Properties, base structPointer) error {
+	structp := structPointer_GetStructPointer(base, p.field)
+	if structPointer_IsNil(structp) {
+		return ErrNil
+	}
+	dur := structPointer_Interface(structp, durationType).(*time.Duration)
+	d := durationProto(*dur)
+	data, err := Marshal(d)
+	if err != nil {
+		return err
+	}
+	o.buf = append(o.buf, p.tagcode...)
+	o.EncodeRawBytes(data)
+	return nil
+}
+
+func size_ref_duration(p *Properties, base structPointer) (n int) {
+	dur := structPointer_InterfaceAt(base, p.field, durationType).(*time.Duration)
+	d := durationProto(*dur)
+	size := Size(d)
+	return size + sizeVarint(uint64(size)) + len(p.tagcode)
+}
+
+func (o *Buffer) enc_ref_duration(p *Properties, base structPointer) error {
+	dur := structPointer_InterfaceAt(base, p.field, durationType).(*time.Duration)
+	d := durationProto(*dur)
+	data, err := Marshal(d)
+	if err != nil {
+		return err
+	}
+	o.buf = append(o.buf, p.tagcode...)
+	o.EncodeRawBytes(data)
+	return nil
+}
+
+func size_slice_duration(p *Properties, base structPointer) (n int) {
+	pdurs := structPointer_InterfaceAt(base, p.field, reflect.SliceOf(reflect.PtrTo(durationType))).(*[]*time.Duration)
+	durs := *pdurs
+	for i := 0; i < len(durs); i++ {
+		if durs[i] == nil {
+			return 0
+		}
+		dproto := durationProto(*durs[i])
+		size := Size(dproto)
+		n += len(p.tagcode) + size + sizeVarint(uint64(size))
+	}
+	return n
+}
+
+func (o *Buffer) enc_slice_duration(p *Properties, base structPointer) error {
+	pdurs := structPointer_InterfaceAt(base, p.field, reflect.SliceOf(reflect.PtrTo(durationType))).(*[]*time.Duration)
+	durs := *pdurs
+	for i := 0; i < len(durs); i++ {
+		if durs[i] == nil {
+			return errRepeatedHasNil
+		}
+		dproto := durationProto(*durs[i])
+		data, err := Marshal(dproto)
+		if err != nil {
+			return err
+		}
+		o.buf = append(o.buf, p.tagcode...)
+		o.EncodeRawBytes(data)
+	}
+	return nil
+}
+
+func size_slice_ref_duration(p *Properties, base structPointer) (n int) {
+	pdurs := structPointer_InterfaceAt(base, p.field, reflect.SliceOf(durationType)).(*[]time.Duration)
+	durs := *pdurs
+	for i := 0; i < len(durs); i++ {
+		dproto := durationProto(durs[i])
+		size := Size(dproto)
+		n += len(p.tagcode) + size + sizeVarint(uint64(size))
+	}
+	return n
+}
+
+func (o *Buffer) enc_slice_ref_duration(p *Properties, base structPointer) error {
+	pdurs := structPointer_InterfaceAt(base, p.field, reflect.SliceOf(durationType)).(*[]time.Duration)
+	durs := *pdurs
+	for i := 0; i < len(durs); i++ {
+		dproto := durationProto(durs[i])
+		data, err := Marshal(dproto)
+		if err != nil {
+			return err
+		}
+		o.buf = append(o.buf, p.tagcode...)
+		o.EncodeRawBytes(data)
+	}
+	return nil
+}

vendor/github.com/gogo/protobuf/proto/encode.go

@@ -70,6 +70,10 @@ var (
 
 	// ErrNil is the error returned if Marshal is called with nil.
 	ErrNil = errors.New("proto: Marshal called with nil")
+
+	// ErrTooLarge is the error returned if Marshal is called with a
+	// message that encodes to >2GB.
+	ErrTooLarge = errors.New("proto: message encodes to over 2 GB")
 )
 
 // The fundamental encoders that put bytes on the wire.
@@ -78,6 +82,10 @@ var (
 
 const maxVarintBytes = 10 // maximum length of a varint
 
+// maxMarshalSize is the largest allowed size of an encoded protobuf,
+// since C++ and Java use signed int32s for the size.
+const maxMarshalSize = 1<<31 - 1
+
 // EncodeVarint returns the varint encoding of x.
 // This is the format for the
 // int32, int64, uint32, uint64, bool, and enum
@@ -226,10 +234,6 @@ func Marshal(pb Message) ([]byte, error) {
 	}
 	p := NewBuffer(nil)
 	err := p.Marshal(pb)
-	var state errorState
-	if err != nil && !state.shouldContinue(err, nil) {
-		return nil, err
-	}
 	if p.buf == nil && err == nil {
 		// Return a non-nil slice on success.
 		return []byte{}, nil
@@ -258,11 +262,8 @@ func (p *Buffer) Marshal(pb Message) error {
 	// Can the object marshal itself?
 	if m, ok := pb.(Marshaler); ok {
 		data, err := m.Marshal()
-		if err != nil {
-			return err
-		}
 		p.buf = append(p.buf, data...)
-		return nil
+		return err
 	}
 
 	t, base, err := getbase(pb)
@@ -274,9 +275,12 @@ func (p *Buffer) Marshal(pb Message) error {
 	}
 
 	if collectStats {
-		stats.Encode++
+		(stats).Encode++ // Parens are to work around a goimports bug.
 	}
 
+	if len(p.buf) > maxMarshalSize {
+		return ErrTooLarge
+	}
 	return err
 }
 
@@ -298,7 +302,7 @@ func Size(pb Message) (n int) {
 	}
 
 	if collectStats {
-		stats.Size++
+		(stats).Size++ // Parens are to work around a goimports bug.
 	}
 
 	return
@@ -1003,7 +1007,6 @@ func size_slice_struct_message(p *Properties, base structPointer) (n int) {
 		if p.isMarshaler {
 			m := structPointer_Interface(structp, p.stype).(Marshaler)
 			data, _ := m.Marshal()
-			n += len(p.tagcode)
 			n += sizeRawBytes(data)
 			continue
 		}
@@ -1062,10 +1065,32 @@ func size_slice_struct_group(p *Properties, base structPointer) (n int) {
 
 // Encode an extension map.
 func (o *Buffer) enc_map(p *Properties, base structPointer) error {
-	v := *structPointer_ExtMap(base, p.field)
-	if err := encodeExtensionMap(v); err != nil {
+	exts := structPointer_ExtMap(base, p.field)
+	if err := encodeExtensionsMap(*exts); err != nil {
 		return err
 	}
+
+	return o.enc_map_body(*exts)
+}
+
+func (o *Buffer) enc_exts(p *Properties, base structPointer) error {
+	exts := structPointer_Extensions(base, p.field)
+
+	v, mu := exts.extensionsRead()
+	if v == nil {
+		return nil
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+	if err := encodeExtensionsMap(v); err != nil {
+		return err
+	}
+
+	return o.enc_map_body(v)
+}
+
+func (o *Buffer) enc_map_body(v map[int32]Extension) error {
 	// Fast-path for common cases: zero or one extensions.
 	if len(v) <= 1 {
 		for _, e := range v {
@@ -1088,8 +1113,13 @@ func (o *Buffer) enc_map(p *Properties, base structPointer) error {
 }
 
 func size_map(p *Properties, base structPointer) int {
-	v := *structPointer_ExtMap(base, p.field)
-	return sizeExtensionMap(v)
+	v := structPointer_ExtMap(base, p.field)
+	return extensionsMapSize(*v)
+}
+
+func size_exts(p *Properties, base structPointer) int {
+	v := structPointer_Extensions(base, p.field)
+	return extensionsSize(v)
 }
 
 // Encode a map field.
@@ -1118,7 +1148,7 @@ func (o *Buffer) enc_new_map(p *Properties, base structPointer) error {
 		if err := p.mkeyprop.enc(o, p.mkeyprop, keybase); err != nil {
 			return err
 		}
-		if err := p.mvalprop.enc(o, p.mvalprop, valbase); err != nil {
+		if err := p.mvalprop.enc(o, p.mvalprop, valbase); err != nil && err != ErrNil {
 			return err
 		}
 		return nil
@@ -1128,11 +1158,6 @@ func (o *Buffer) enc_new_map(p *Properties, base structPointer) error {
 	for _, key := range v.MapKeys() {
 		val := v.MapIndex(key)
 
-		// The only illegal map entry values are nil message pointers.
-		if val.Kind() == reflect.Ptr && val.IsNil() {
-			return errors.New("proto: map has nil element")
-		}
-
 		keycopy.Set(key)
 		valcopy.Set(val)
 
@@ -1220,6 +1245,9 @@ func (o *Buffer) enc_struct(prop *StructProperties, base structPointer) error {
 					return err
 				}
 			}
+			if len(o.buf) > maxMarshalSize {
+				return ErrTooLarge
+			}
 		}
 	}
 
@@ -1236,6 +1264,9 @@ func (o *Buffer) enc_struct(prop *StructProperties, base structPointer) error {
 	// Add unrecognized fields at the end.
 	if prop.unrecField.IsValid() {
 		v := *structPointer_Bytes(base, prop.unrecField)
+		if len(o.buf)+len(v) > maxMarshalSize {
+			return ErrTooLarge
+		}
 		if len(v) > 0 {
 			o.buf = append(o.buf, v...)
 		}

vendor/github.com/gogo/protobuf/proto/encode_gogo.go

@@ -1,7 +1,7 @@
-// Extensions for Protocol Buffers to create more go like structures.
+// Protocol Buffers for Go with Gadgets
 //
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Go support for Protocol Buffers - Google's data interchange format
 //
@@ -196,12 +196,10 @@ func size_ref_struct_message(p *Properties, base structPointer) int {
 // Encode a slice of references to message struct pointers ([]struct).
 func (o *Buffer) enc_slice_ref_struct_message(p *Properties, base structPointer) error {
 	var state errorState
-	ss := structPointer_GetStructPointer(base, p.field)
-	ss1 := structPointer_GetRefStructPointer(ss, field(0))
-	size := p.stype.Size()
-	l := structPointer_Len(base, p.field)
+	ss := structPointer_StructRefSlice(base, p.field, p.stype.Size())
+	l := ss.Len()
 	for i := 0; i < l; i++ {
-		structp := structPointer_Add(ss1, field(uintptr(i)*size))
+		structp := ss.Index(i)
 		if structPointer_IsNil(structp) {
 			return errRepeatedHasNil
 		}
@@ -233,13 +231,11 @@ func (o *Buffer) enc_slice_ref_struct_message(p *Properties, base structPointer)
 
 //TODO this is only copied, please fix this
 func size_slice_ref_struct_message(p *Properties, base structPointer) (n int) {
-	ss := structPointer_GetStructPointer(base, p.field)
-	ss1 := structPointer_GetRefStructPointer(ss, field(0))
-	size := p.stype.Size()
-	l := structPointer_Len(base, p.field)
+	ss := structPointer_StructRefSlice(base, p.field, p.stype.Size())
+	l := ss.Len()
 	n += l * len(p.tagcode)
 	for i := 0; i < l; i++ {
-		structp := structPointer_Add(ss1, field(uintptr(i)*size))
+		structp := ss.Index(i)
 		if structPointer_IsNil(structp) {
 			return // return the size up to this point
 		}

vendor/github.com/gogo/protobuf/proto/equal.go

@@ -54,13 +54,17 @@ Equality is defined in this way:
     in a proto3 .proto file, fields are not "set"; specifically,
     zero length proto3 "bytes" fields are equal (nil == {}).
   - Two repeated fields are equal iff their lengths are the same,
-    and their corresponding elements are equal (a "bytes" field,
-    although represented by []byte, is not a repeated field)
+    and their corresponding elements are equal. Note a "bytes" field,
+    although represented by []byte, is not a repeated field and the
+    rule for the scalar fields described above applies.
   - Two unset fields are equal.
   - Two unknown field sets are equal if their current
     encoded state is equal.
   - Two extension sets are equal iff they have corresponding
     elements that are pairwise equal.
+  - Two map fields are equal iff their lengths are the same,
+    and they contain the same set of elements. Zero-length map
+    fields are equal.
   - Every other combination of things are not equal.
 
 The return value is undefined if a and b are not protocol buffers.
@@ -121,9 +125,16 @@ func equalStruct(v1, v2 reflect.Value) bool {
 		}
 	}
 
+	if em1 := v1.FieldByName("XXX_InternalExtensions"); em1.IsValid() {
+		em2 := v2.FieldByName("XXX_InternalExtensions")
+		if !equalExtensions(v1.Type(), em1.Interface().(XXX_InternalExtensions), em2.Interface().(XXX_InternalExtensions)) {
+			return false
+		}
+	}
+
 	if em1 := v1.FieldByName("XXX_extensions"); em1.IsValid() {
 		em2 := v2.FieldByName("XXX_extensions")
-		if !equalExtensions(v1.Type(), em1.Interface().(map[int32]Extension), em2.Interface().(map[int32]Extension)) {
+		if !equalExtMap(v1.Type(), em1.Interface().(map[int32]Extension), em2.Interface().(map[int32]Extension)) {
 			return false
 		}
 	}
@@ -184,6 +195,13 @@ func equalAny(v1, v2 reflect.Value, prop *Properties) bool {
 		}
 		return true
 	case reflect.Ptr:
+		// Maps may have nil values in them, so check for nil.
+		if v1.IsNil() && v2.IsNil() {
+			return true
+		}
+		if v1.IsNil() != v2.IsNil() {
+			return false
+		}
 		return equalAny(v1.Elem(), v2.Elem(), prop)
 	case reflect.Slice:
 		if v1.Type().Elem().Kind() == reflect.Uint8 {
@@ -223,8 +241,14 @@ func equalAny(v1, v2 reflect.Value, prop *Properties) bool {
 }
 
 // base is the struct type that the extensions are based on.
-// em1 and em2 are extension maps.
-func equalExtensions(base reflect.Type, em1, em2 map[int32]Extension) bool {
+// x1 and x2 are InternalExtensions.
+func equalExtensions(base reflect.Type, x1, x2 XXX_InternalExtensions) bool {
+	em1, _ := x1.extensionsRead()
+	em2, _ := x2.extensionsRead()
+	return equalExtMap(base, em1, em2)
+}
+
+func equalExtMap(base reflect.Type, em1, em2 map[int32]Extension) bool {
 	if len(em1) != len(em2) {
 		return false
 	}

vendor/github.com/gogo/protobuf/proto/extensions.go

@@ -52,23 +52,112 @@ type ExtensionRange struct {
 	Start, End int32 // both inclusive
 }
 
-// extendableProto is an interface implemented by any protocol buffer that may be extended.
+// extendableProto is an interface implemented by any protocol buffer generated by the current
+// proto compiler that may be extended.
 type extendableProto interface {
 	Message
 	ExtensionRangeArray() []ExtensionRange
+	extensionsWrite() map[int32]Extension
+	extensionsRead() (map[int32]Extension, sync.Locker)
 }
 
-type extensionsMap interface {
-	extendableProto
+// extendableProtoV1 is an interface implemented by a protocol buffer generated by the previous
+// version of the proto compiler that may be extended.
+type extendableProtoV1 interface {
+	Message
+	ExtensionRangeArray() []ExtensionRange
 	ExtensionMap() map[int32]Extension
 }
 
 type extensionsBytes interface {
-	extendableProto
+	Message
+	ExtensionRangeArray() []ExtensionRange
 	GetExtensions() *[]byte
 }
 
+// extensionAdapter is a wrapper around extendableProtoV1 that implements extendableProto.
+type extensionAdapter struct {
+	extendableProtoV1
+}
+
+func (e extensionAdapter) extensionsWrite() map[int32]Extension {
+	return e.ExtensionMap()
+}
+
+func (e extensionAdapter) extensionsRead() (map[int32]Extension, sync.Locker) {
+	return e.ExtensionMap(), notLocker{}
+}
+
+// notLocker is a sync.Locker whose Lock and Unlock methods are nops.
+type notLocker struct{}
+
+func (n notLocker) Lock()   {}
+func (n notLocker) Unlock() {}
+
+// extendable returns the extendableProto interface for the given generated proto message.
+// If the proto message has the old extension format, it returns a wrapper that implements
+// the extendableProto interface.
+func extendable(p interface{}) (extendableProto, bool) {
+	if ep, ok := p.(extendableProto); ok {
+		return ep, ok
+	}
+	if ep, ok := p.(extendableProtoV1); ok {
+		return extensionAdapter{ep}, ok
+	}
+	return nil, false
+}
+
+// XXX_InternalExtensions is an internal representation of proto extensions.
+//
+// Each generated message struct type embeds an anonymous XXX_InternalExtensions field,
+// thus gaining the unexported 'extensions' method, which can be called only from the proto package.
+//
+// The methods of XXX_InternalExtensions are not concurrency safe in general,
+// but calls to logically read-only methods such as has and get may be executed concurrently.
+type XXX_InternalExtensions struct {
+	// The struct must be indirect so that if a user inadvertently copies a
+	// generated message and its embedded XXX_InternalExtensions, they
+	// avoid the mayhem of a copied mutex.
+	//
+	// The mutex serializes all logically read-only operations to p.extensionMap.
+	// It is up to the client to ensure that write operations to p.extensionMap are
+	// mutually exclusive with other accesses.
+	p *struct {
+		mu           sync.Mutex
+		extensionMap map[int32]Extension
+	}
+}
+
+// extensionsWrite returns the extension map, creating it on first use.
+func (e *XXX_InternalExtensions) extensionsWrite() map[int32]Extension {
+	if e.p == nil {
+		e.p = new(struct {
+			mu           sync.Mutex
+			extensionMap map[int32]Extension
+		})
+		e.p.extensionMap = make(map[int32]Extension)
+	}
+	return e.p.extensionMap
+}
+
+// extensionsRead returns the extensions map for read-only use.  It may be nil.
+// The caller must hold the returned mutex's lock when accessing Elements within the map.
+func (e *XXX_InternalExtensions) extensionsRead() (map[int32]Extension, sync.Locker) {
+	if e.p == nil {
+		return nil, nil
+	}
+	return e.p.extensionMap, &e.p.mu
+}
+
+type extensionRange interface {
+	Message
+	ExtensionRangeArray() []ExtensionRange
+}
+
 var extendableProtoType = reflect.TypeOf((*extendableProto)(nil)).Elem()
+var extendableProtoV1Type = reflect.TypeOf((*extendableProtoV1)(nil)).Elem()
+var extendableBytesType = reflect.TypeOf((*extensionsBytes)(nil)).Elem()
+var extensionRangeType = reflect.TypeOf((*extensionRange)(nil)).Elem()
 
 // ExtensionDesc represents an extension specification.
 // Used in generated code from the protocol compiler.
@@ -78,6 +167,7 @@ type ExtensionDesc struct {
 	Field         int32       // field number
 	Name          string      // fully-qualified name of extension, for text formatting
 	Tag           string      // protobuf tag style
+	Filename      string      // name of the file in which the extension is defined
 }
 
 func (ed *ExtensionDesc) repeated() bool {
@@ -101,20 +191,23 @@ type Extension struct {
 }
 
 // SetRawExtension is for testing only.
-func SetRawExtension(base extendableProto, id int32, b []byte) {
-	if ebase, ok := base.(extensionsMap); ok {
-		ebase.ExtensionMap()[id] = Extension{enc: b}
-	} else if ebase, ok := base.(extensionsBytes); ok {
+func SetRawExtension(base Message, id int32, b []byte) {
+	if ebase, ok := base.(extensionsBytes); ok {
 		clearExtension(base, id)
 		ext := ebase.GetExtensions()
 		*ext = append(*ext, b...)
-	} else {
-		panic("unreachable")
+		return
 	}
+	epb, ok := extendable(base)
+	if !ok {
+		return
+	}
+	extmap := epb.extensionsWrite()
+	extmap[id] = Extension{enc: b}
 }
 
 // isExtensionField returns true iff the given field number is in an extension range.
-func isExtensionField(pb extendableProto, field int32) bool {
+func isExtensionField(pb extensionRange, field int32) bool {
 	for _, er := range pb.ExtensionRangeArray() {
 		if er.Start <= field && field <= er.End {
 			return true
@@ -125,8 +218,12 @@ func isExtensionField(pb extendableProto, field int32) bool {
 
 // checkExtensionTypes checks that the given extension is valid for pb.
 func checkExtensionTypes(pb extendableProto, extension *ExtensionDesc) error {
+	var pbi interface{} = pb
 	// Check the extended type.
-	if a, b := reflect.TypeOf(pb), reflect.TypeOf(extension.ExtendedType); a != b {
+	if ea, ok := pbi.(extensionAdapter); ok {
+		pbi = ea.extendableProtoV1
+	}
+	if a, b := reflect.TypeOf(pbi), reflect.TypeOf(extension.ExtendedType); a != b {
 		return errors.New("proto: bad extended type; " + b.String() + " does not extend " + a.String())
 	}
 	// Check the range.
@@ -172,43 +269,57 @@ func extensionProperties(ed *ExtensionDesc) *Properties {
 	return prop
 }
 
-// encodeExtensionMap encodes any unmarshaled (unencoded) extensions in m.
-func encodeExtensionMap(m map[int32]Extension) error {
+// encode encodes any unmarshaled (unencoded) extensions in e.
+func encodeExtensions(e *XXX_InternalExtensions) error {
+	m, mu := e.extensionsRead()
+	if m == nil {
+		return nil // fast path
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	return encodeExtensionsMap(m)
+}
+
+// encode encodes any unmarshaled (unencoded) extensions in e.
+func encodeExtensionsMap(m map[int32]Extension) error {
 	for k, e := range m {
-		err := encodeExtension(&e)
-		if err != nil {
+		if e.value == nil || e.desc == nil {
+			// Extension is only in its encoded form.
+			continue
+		}
+
+		// We don't skip extensions that have an encoded form set,
+		// because the extension value may have been mutated after
+		// the last time this function was called.
+
+		et := reflect.TypeOf(e.desc.ExtensionType)
+		props := extensionProperties(e.desc)
+
+		p := NewBuffer(nil)
+		// If e.value has type T, the encoder expects a *struct{ X T }.
+		// Pass a *T with a zero field and hope it all works out.
+		x := reflect.New(et)
+		x.Elem().Set(reflect.ValueOf(e.value))
+		if err := props.enc(p, props, toStructPointer(x)); err != nil {
 			return err
 		}
+		e.enc = p.buf
 		m[k] = e
 	}
 	return nil
 }
 
-func encodeExtension(e *Extension) error {
-	if e.value == nil || e.desc == nil {
-		// Extension is only in its encoded form.
-		return nil
+func extensionsSize(e *XXX_InternalExtensions) (n int) {
+	m, mu := e.extensionsRead()
+	if m == nil {
+		return 0
 	}
-	// We don't skip extensions that have an encoded form set,
-	// because the extension value may have been mutated after
-	// the last time this function was called.
-
-	et := reflect.TypeOf(e.desc.ExtensionType)
-	props := extensionProperties(e.desc)
-
-	p := NewBuffer(nil)
-	// If e.value has type T, the encoder expects a *struct{ X T }.
-	// Pass a *T with a zero field and hope it all works out.
-	x := reflect.New(et)
-	x.Elem().Set(reflect.ValueOf(e.value))
-	if err := props.enc(p, props, toStructPointer(x)); err != nil {
-		return err
-	}
-	e.enc = p.buf
-	return nil
+	mu.Lock()
+	defer mu.Unlock()
+	return extensionsMapSize(m)
 }
 
-func sizeExtensionMap(m map[int32]Extension) (n int) {
+func extensionsMapSize(m map[int32]Extension) (n int) {
 	for _, e := range m {
 		if e.value == nil || e.desc == nil {
 			// Extension is only in its encoded form.
@@ -233,12 +344,8 @@ func sizeExtensionMap(m map[int32]Extension) (n int) {
 }
 
 // HasExtension returns whether the given extension is present in pb.
-func HasExtension(pb extendableProto, extension *ExtensionDesc) bool {
-	// TODO: Check types, field numbers, etc.?
-	if epb, doki := pb.(extensionsMap); doki {
-		_, ok := epb.ExtensionMap()[extension.Field]
-		return ok
-	} else if epb, doki := pb.(extensionsBytes); doki {
+func HasExtension(pb Message, extension *ExtensionDesc) bool {
+	if epb, doki := pb.(extensionsBytes); doki {
 		ext := epb.GetExtensions()
 		buf := *ext
 		o := 0
@@ -258,7 +365,19 @@ func HasExtension(pb extendableProto, extension *ExtensionDesc) bool {
 		}
 		return false
 	}
-	panic("unreachable")
+	// TODO: Check types, field numbers, etc.?
+	epb, ok := extendable(pb)
+	if !ok {
+		return false
+	}
+	extmap, mu := epb.extensionsRead()
+	if extmap == nil {
+		return false
+	}
+	mu.Lock()
+	_, ok = extmap[extension.Field]
+	mu.Unlock()
+	return ok
 }
 
 func deleteExtension(pb extensionsBytes, theFieldNum int32, offset int) int {
@@ -281,64 +400,32 @@ func deleteExtension(pb extensionsBytes, theFieldNum int32, offset int) int {
 	return -1
 }
 
-func clearExtension(pb extendableProto, fieldNum int32) {
-	if epb, doki := pb.(extensionsMap); doki {
-		delete(epb.ExtensionMap(), fieldNum)
-	} else if epb, doki := pb.(extensionsBytes); doki {
+// ClearExtension removes the given extension from pb.
+func ClearExtension(pb Message, extension *ExtensionDesc) {
+	clearExtension(pb, extension.Field)
+}
+
+func clearExtension(pb Message, fieldNum int32) {
+	if epb, doki := pb.(extensionsBytes); doki {
 		offset := 0
 		for offset != -1 {
 			offset = deleteExtension(epb, fieldNum, offset)
 		}
-	} else {
-		panic("unreachable")
+		return
+	}
+	epb, ok := extendable(pb)
+	if !ok {
+		return
 	}
-}
-
-// ClearExtension removes the given extension from pb.
-func ClearExtension(pb extendableProto, extension *ExtensionDesc) {
 	// TODO: Check types, field numbers, etc.?
-	clearExtension(pb, extension.Field)
+	extmap := epb.extensionsWrite()
+	delete(extmap, fieldNum)
 }
 
 // GetExtension parses and returns the given extension of pb.
-// If the extension is not present it returns ErrMissingExtension.
-func GetExtension(pb extendableProto, extension *ExtensionDesc) (interface{}, error) {
-	if err := checkExtensionTypes(pb, extension); err != nil {
-		return nil, err
-	}
-
-	if epb, doki := pb.(extensionsMap); doki {
-		emap := epb.ExtensionMap()
-		e, ok := emap[extension.Field]
-		if !ok {
-			// defaultExtensionValue returns the default value or
-			// ErrMissingExtension if there is no default.
-			return defaultExtensionValue(extension)
-		}
-		if e.value != nil {
-			// Already decoded. Check the descriptor, though.
-			if e.desc != extension {
-				// This shouldn't happen. If it does, it means that
-				// GetExtension was called twice with two different
-				// descriptors with the same field number.
-				return nil, errors.New("proto: descriptor conflict")
-			}
-			return e.value, nil
-		}
-
-		v, err := decodeExtension(e.enc, extension)
-		if err != nil {
-			return nil, err
-		}
-
-		// Remember the decoded version and drop the encoded version.
-		// That way it is safe to mutate what we return.
-		e.value = v
-		e.desc = extension
-		e.enc = nil
-		emap[extension.Field] = e
-		return e.value, nil
-	} else if epb, doki := pb.(extensionsBytes); doki {
+// If the extension is not present and has no default value it returns ErrMissingExtension.
+func GetExtension(pb Message, extension *ExtensionDesc) (interface{}, error) {
+	if epb, doki := pb.(extensionsBytes); doki {
 		ext := epb.GetExtensions()
 		o := 0
 		for o < len(*ext) {
@@ -360,7 +447,50 @@ func GetExtension(pb extendableProto, extension *ExtensionDesc) (interface{}, er
 		}
 		return defaultExtensionValue(extension)
 	}
-	panic("unreachable")
+	epb, ok := extendable(pb)
+	if !ok {
+		return nil, errors.New("proto: not an extendable proto")
+	}
+	if err := checkExtensionTypes(epb, extension); err != nil {
+		return nil, err
+	}
+
+	emap, mu := epb.extensionsRead()
+	if emap == nil {
+		return defaultExtensionValue(extension)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	e, ok := emap[extension.Field]
+	if !ok {
+		// defaultExtensionValue returns the default value or
+		// ErrMissingExtension if there is no default.
+		return defaultExtensionValue(extension)
+	}
+
+	if e.value != nil {
+		// Already decoded. Check the descriptor, though.
+		if e.desc != extension {
+			// This shouldn't happen. If it does, it means that
+			// GetExtension was called twice with two different
+			// descriptors with the same field number.
+			return nil, errors.New("proto: descriptor conflict")
+		}
+		return e.value, nil
+	}
+
+	v, err := decodeExtension(e.enc, extension)
+	if err != nil {
+		return nil, err
+	}
+
+	// Remember the decoded version and drop the encoded version.
+	// That way it is safe to mutate what we return.
+	e.value = v
+	e.desc = extension
+	e.enc = nil
+	emap[extension.Field] = e
+	return e.value, nil
 }
 
 // defaultExtensionValue returns the default value for extension.
@@ -434,14 +564,9 @@ func decodeExtension(b []byte, extension *ExtensionDesc) (interface{}, error) {
 // GetExtensions returns a slice of the extensions present in pb that are also listed in es.
 // The returned slice has the same length as es; missing extensions will appear as nil elements.
 func GetExtensions(pb Message, es []*ExtensionDesc) (extensions []interface{}, err error) {
-	epb, ok := pb.(extendableProto)
-	if !ok {
-		err = errors.New("proto: not an extendable proto")
-		return
-	}
 	extensions = make([]interface{}, len(es))
 	for i, e := range es {
-		extensions[i], err = GetExtension(epb, e)
+		extensions[i], err = GetExtension(pb, e)
 		if err == ErrMissingExtension {
 			err = nil
 		}
@@ -452,9 +577,58 @@ func GetExtensions(pb Message, es []*ExtensionDesc) (extensions []interface{}, e
 	return
 }
 
+// ExtensionDescs returns a new slice containing pb's extension descriptors, in undefined order.
+// For non-registered extensions, ExtensionDescs returns an incomplete descriptor containing
+// just the Field field, which defines the extension's field number.
+func ExtensionDescs(pb Message) ([]*ExtensionDesc, error) {
+	epb, ok := extendable(pb)
+	if !ok {
+		return nil, fmt.Errorf("proto: %T is not an extendable proto.Message", pb)
+	}
+	registeredExtensions := RegisteredExtensions(pb)
+
+	emap, mu := epb.extensionsRead()
+	if emap == nil {
+		return nil, nil
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	extensions := make([]*ExtensionDesc, 0, len(emap))
+	for extid, e := range emap {
+		desc := e.desc
+		if desc == nil {
+			desc = registeredExtensions[extid]
+			if desc == nil {
+				desc = &ExtensionDesc{Field: extid}
+			}
+		}
+
+		extensions = append(extensions, desc)
+	}
+	return extensions, nil
+}
+
 // SetExtension sets the specified extension of pb to the specified value.
-func SetExtension(pb extendableProto, extension *ExtensionDesc, value interface{}) error {
-	if err := checkExtensionTypes(pb, extension); err != nil {
+func SetExtension(pb Message, extension *ExtensionDesc, value interface{}) error {
+	if epb, doki := pb.(extensionsBytes); doki {
+		ClearExtension(pb, extension)
+		ext := epb.GetExtensions()
+		et := reflect.TypeOf(extension.ExtensionType)
+		props := extensionProperties(extension)
+		p := NewBuffer(nil)
+		x := reflect.New(et)
+		x.Elem().Set(reflect.ValueOf(value))
+		if err := props.enc(p, props, toStructPointer(x)); err != nil {
+			return err
+		}
+		*ext = append(*ext, p.buf...)
+		return nil
+	}
+	epb, ok := extendable(pb)
+	if !ok {
+		return errors.New("proto: not an extendable proto")
+	}
+	if err := checkExtensionTypes(epb, extension); err != nil {
 		return err
 	}
 	typ := reflect.TypeOf(extension.ExtensionType)
@@ -469,26 +643,27 @@ func SetExtension(pb extendableProto, extension *ExtensionDesc, value interface{
 	if reflect.ValueOf(value).IsNil() {
 		return fmt.Errorf("proto: SetExtension called with nil value of type %T", value)
 	}
-	return setExtension(pb, extension, value)
+
+	extmap := epb.extensionsWrite()
+	extmap[extension.Field] = Extension{desc: extension, value: value}
+	return nil
 }
 
-func setExtension(pb extendableProto, extension *ExtensionDesc, value interface{}) error {
-	if epb, doki := pb.(extensionsMap); doki {
-		epb.ExtensionMap()[extension.Field] = Extension{desc: extension, value: value}
-	} else if epb, doki := pb.(extensionsBytes); doki {
-		ClearExtension(pb, extension)
+// ClearAllExtensions clears all extensions from pb.
+func ClearAllExtensions(pb Message) {
+	if epb, doki := pb.(extensionsBytes); doki {
 		ext := epb.GetExtensions()
-		et := reflect.TypeOf(extension.ExtensionType)
-		props := extensionProperties(extension)
-		p := NewBuffer(nil)
-		x := reflect.New(et)
-		x.Elem().Set(reflect.ValueOf(value))
-		if err := props.enc(p, props, toStructPointer(x)); err != nil {
-			return err
-		}
-		*ext = append(*ext, p.buf...)
+		*ext = []byte{}
+		return
+	}
+	epb, ok := extendable(pb)
+	if !ok {
+		return
+	}
+	m := epb.extensionsWrite()
+	for k := range m {
+		delete(m, k)
 	}
-	return nil
 }
 
 // A global registry of extensions.

vendor/github.com/gogo/protobuf/proto/extensions_gogo.go

@@ -1,5 +1,7 @@
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -33,9 +35,10 @@ import (
 	"reflect"
 	"sort"
 	"strings"
+	"sync"
 )
 
-func GetBoolExtension(pb extendableProto, extension *ExtensionDesc, ifnotset bool) bool {
+func GetBoolExtension(pb Message, extension *ExtensionDesc, ifnotset bool) bool {
 	if reflect.ValueOf(pb).IsNil() {
 		return ifnotset
 	}
@@ -60,8 +63,12 @@ func (this *Extension) Compare(that *Extension) int {
 	return bytes.Compare(this.enc, that.enc)
 }
 
+func SizeOfInternalExtension(m extendableProto) (n int) {
+	return SizeOfExtensionMap(m.extensionsWrite())
+}
+
 func SizeOfExtensionMap(m map[int32]Extension) (n int) {
-	return sizeExtensionMap(m)
+	return extensionsMapSize(m)
 }
 
 type sortableMapElem struct {
@@ -94,6 +101,10 @@ func (this sortableExtensions) String() string {
 	return "map[" + strings.Join(ss, ",") + "]"
 }
 
+func StringFromInternalExtension(m extendableProto) string {
+	return StringFromExtensionsMap(m.extensionsWrite())
+}
+
 func StringFromExtensionsMap(m map[int32]Extension) string {
 	return newSortableExtensionsFromMap(m).String()
 }
@@ -106,8 +117,12 @@ func StringFromExtensionsBytes(ext []byte) string {
 	return StringFromExtensionsMap(m)
 }
 
+func EncodeInternalExtension(m extendableProto, data []byte) (n int, err error) {
+	return EncodeExtensionMap(m.extensionsWrite(), data)
+}
+
 func EncodeExtensionMap(m map[int32]Extension, data []byte) (n int, err error) {
-	if err := encodeExtensionMap(m); err != nil {
+	if err := encodeExtensionsMap(m); err != nil {
 		return 0, err
 	}
 	keys := make([]int, 0, len(m))
@@ -125,7 +140,7 @@ func GetRawExtension(m map[int32]Extension, id int32) ([]byte, error) {
 	if m[id].value == nil || m[id].desc == nil {
 		return m[id].enc, nil
 	}
-	if err := encodeExtensionMap(m); err != nil {
+	if err := encodeExtensionsMap(m); err != nil {
 		return nil, err
 	}
 	return m[id].enc, nil
@@ -189,15 +204,42 @@ func NewExtension(e []byte) Extension {
 	return ee
 }
 
-func AppendExtension(e extendableProto, tag int32, buf []byte) {
-	if ee, eok := e.(extensionsMap); eok {
-		ext := ee.ExtensionMap()[int32(tag)] // may be missing
-		ext.enc = append(ext.enc, buf...)
-		ee.ExtensionMap()[int32(tag)] = ext
-	} else if ee, eok := e.(extensionsBytes); eok {
+func AppendExtension(e Message, tag int32, buf []byte) {
+	if ee, eok := e.(extensionsBytes); eok {
 		ext := ee.GetExtensions()
 		*ext = append(*ext, buf...)
+		return
 	}
+	if ee, eok := e.(extendableProto); eok {
+		m := ee.extensionsWrite()
+		ext := m[int32(tag)] // may be missing
+		ext.enc = append(ext.enc, buf...)
+		m[int32(tag)] = ext
+	}
+}
+
+func encodeExtension(e *Extension) error {
+	if e.value == nil || e.desc == nil {
+		// Extension is only in its encoded form.
+		return nil
+	}
+	// We don't skip extensions that have an encoded form set,
+	// because the extension value may have been mutated after
+	// the last time this function was called.
+
+	et := reflect.TypeOf(e.desc.ExtensionType)
+	props := extensionProperties(e.desc)
+
+	p := NewBuffer(nil)
+	// If e.value has type T, the encoder expects a *struct{ X T }.
+	// Pass a *T with a zero field and hope it all works out.
+	x := reflect.New(et)
+	x.Elem().Set(reflect.ValueOf(e.value))
+	if err := props.enc(p, props, toStructPointer(x)); err != nil {
+		return err
+	}
+	e.enc = p.buf
+	return nil
 }
 
 func (this Extension) GoString() string {
@@ -209,7 +251,7 @@ func (this Extension) GoString() string {
 	return fmt.Sprintf("proto.NewExtension(%#v)", this.enc)
 }
 
-func SetUnsafeExtension(pb extendableProto, fieldNum int32, value interface{}) error {
+func SetUnsafeExtension(pb Message, fieldNum int32, value interface{}) error {
 	typ := reflect.TypeOf(pb).Elem()
 	ext, ok := extensionMaps[typ]
 	if !ok {
@@ -219,10 +261,10 @@ func SetUnsafeExtension(pb extendableProto, fieldNum int32, value interface{}) e
 	if !ok {
 		return errors.New("proto: bad extension number; not in declared ranges")
 	}
-	return setExtension(pb, desc, value)
+	return SetExtension(pb, desc, value)
 }
 
-func GetUnsafeExtension(pb extendableProto, fieldNum int32) (interface{}, error) {
+func GetUnsafeExtension(pb Message, fieldNum int32) (interface{}, error) {
 	typ := reflect.TypeOf(pb).Elem()
 	ext, ok := extensionMaps[typ]
 	if !ok {
@@ -234,3 +276,19 @@ func GetUnsafeExtension(pb extendableProto, fieldNum int32) (interface{}, error)
 	}
 	return GetExtension(pb, desc)
 }
+
+func NewUnsafeXXX_InternalExtensions(m map[int32]Extension) XXX_InternalExtensions {
+	x := &XXX_InternalExtensions{
+		p: new(struct {
+			mu           sync.Mutex
+			extensionMap map[int32]Extension
+		}),
+	}
+	x.p.extensionMap = m
+	return *x
+}
+
+func GetUnsafeExtensionsMap(extendable Message) map[int32]Extension {
+	pb := extendable.(extendableProto)
+	return pb.extensionsWrite()
+}

vendor/github.com/gogo/protobuf/proto/lib.go

@@ -308,7 +308,7 @@ func GetStats() Stats { return stats }
 // temporary Buffer and are fine for most applications.
 type Buffer struct {
 	buf   []byte // encode/decode byte stream
-	index int    // write point
+	index int    // read point
 
 	// pools of basic types to amortize allocation.
 	bools   []bool
@@ -889,6 +889,10 @@ func isProto3Zero(v reflect.Value) bool {
 	return false
 }
 
+// ProtoPackageIsVersion2 is referenced from generated protocol buffer files
+// to assert that that code is compatible with this version of the proto package.
+const GoGoProtoPackageIsVersion2 = true
+
 // ProtoPackageIsVersion1 is referenced from generated protocol buffer files
 // to assert that that code is compatible with this version of the proto package.
 const GoGoProtoPackageIsVersion1 = true

vendor/github.com/gogo/protobuf/proto/lib_gogo.go

@@ -1,5 +1,7 @@
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are

vendor/github.com/gogo/protobuf/proto/message_set.go

@@ -149,9 +149,21 @@ func skipVarint(buf []byte) []byte {
 
 // MarshalMessageSet encodes the extension map represented by m in the message set wire format.
 // It is called by generated Marshal methods on protocol buffer messages with the message_set_wire_format option.
-func MarshalMessageSet(m map[int32]Extension) ([]byte, error) {
-	if err := encodeExtensionMap(m); err != nil {
-		return nil, err
+func MarshalMessageSet(exts interface{}) ([]byte, error) {
+	var m map[int32]Extension
+	switch exts := exts.(type) {
+	case *XXX_InternalExtensions:
+		if err := encodeExtensions(exts); err != nil {
+			return nil, err
+		}
+		m, _ = exts.extensionsRead()
+	case map[int32]Extension:
+		if err := encodeExtensionsMap(exts); err != nil {
+			return nil, err
+		}
+		m = exts
+	default:
+		return nil, errors.New("proto: not an extension map")
 	}
 
 	// Sort extension IDs to provide a deterministic encoding.
@@ -178,7 +190,17 @@ func MarshalMessageSet(m map[int32]Extension) ([]byte, error) {
 
 // UnmarshalMessageSet decodes the extension map encoded in buf in the message set wire format.
 // It is called by generated Unmarshal methods on protocol buffer messages with the message_set_wire_format option.
-func UnmarshalMessageSet(buf []byte, m map[int32]Extension) error {
+func UnmarshalMessageSet(buf []byte, exts interface{}) error {
+	var m map[int32]Extension
+	switch exts := exts.(type) {
+	case *XXX_InternalExtensions:
+		m = exts.extensionsWrite()
+	case map[int32]Extension:
+		m = exts
+	default:
+		return errors.New("proto: not an extension map")
+	}
+
 	ms := new(messageSet)
 	if err := Unmarshal(buf, ms); err != nil {
 		return err
@@ -209,7 +231,16 @@ func UnmarshalMessageSet(buf []byte, m map[int32]Extension) error {
 
 // MarshalMessageSetJSON encodes the extension map represented by m in JSON format.
 // It is called by generated MarshalJSON methods on protocol buffer messages with the message_set_wire_format option.
-func MarshalMessageSetJSON(m map[int32]Extension) ([]byte, error) {
+func MarshalMessageSetJSON(exts interface{}) ([]byte, error) {
+	var m map[int32]Extension
+	switch exts := exts.(type) {
+	case *XXX_InternalExtensions:
+		m, _ = exts.extensionsRead()
+	case map[int32]Extension:
+		m = exts
+	default:
+		return nil, errors.New("proto: not an extension map")
+	}
 	var b bytes.Buffer
 	b.WriteByte('{')
 
@@ -252,7 +283,7 @@ func MarshalMessageSetJSON(m map[int32]Extension) ([]byte, error) {
 
 // UnmarshalMessageSetJSON decodes the extension map encoded in buf in JSON format.
 // It is called by generated UnmarshalJSON methods on protocol buffer messages with the message_set_wire_format option.
-func UnmarshalMessageSetJSON(buf []byte, m map[int32]Extension) error {
+func UnmarshalMessageSetJSON(buf []byte, exts interface{}) error {
 	// Common-case fast path.
 	if len(buf) == 0 || bytes.Equal(buf, []byte("{}")) {
 		return nil

vendor/github.com/gogo/protobuf/proto/pointer_reflect.go

@@ -29,7 +29,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// +build appengine
+// +build appengine js
 
 // This file contains an implementation of proto field accesses using package reflect.
 // It is slower than the code in pointer_unsafe.go but it avoids package unsafe and can
@@ -139,6 +139,11 @@ func structPointer_StringSlice(p structPointer, f field) *[]string {
 	return structPointer_ifield(p, f).(*[]string)
 }
 
+// Extensions returns the address of an extension map field in the struct.
+func structPointer_Extensions(p structPointer, f field) *XXX_InternalExtensions {
+	return structPointer_ifield(p, f).(*XXX_InternalExtensions)
+}
+
 // ExtMap returns the address of an extension map field in the struct.
 func structPointer_ExtMap(p structPointer, f field) *map[int32]Extension {
 	return structPointer_ifield(p, f).(*map[int32]Extension)

vendor/github.com/gogo/protobuf/proto/pointer_reflect_gogo.go

@@ -0,0 +1,85 @@
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2016, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// +build appengine js
+
+package proto
+
+import (
+	"reflect"
+)
+
+func structPointer_FieldPointer(p structPointer, f field) structPointer {
+	panic("not implemented")
+}
+
+func appendStructPointer(base structPointer, f field, typ reflect.Type) structPointer {
+	panic("not implemented")
+}
+
+func structPointer_InterfaceAt(p structPointer, f field, t reflect.Type) interface{} {
+	panic("not implemented")
+}
+
+func structPointer_InterfaceRef(p structPointer, f field, t reflect.Type) interface{} {
+	panic("not implemented")
+}
+
+func structPointer_GetRefStructPointer(p structPointer, f field) structPointer {
+	panic("not implemented")
+}
+
+func structPointer_Add(p structPointer, size field) structPointer {
+	panic("not implemented")
+}
+
+func structPointer_Len(p structPointer, f field) int {
+	panic("not implemented")
+}
+
+func structPointer_GetSliceHeader(p structPointer, f field) *reflect.SliceHeader {
+	panic("not implemented")
+}
+
+func structPointer_Copy(oldptr structPointer, newptr structPointer, size int) {
+	panic("not implemented")
+}
+
+func structPointer_StructRefSlice(p structPointer, f field, size uintptr) *structRefSlice {
+	panic("not implemented")
+}
+
+type structRefSlice struct{}
+
+func (v *structRefSlice) Len() int {
+	panic("not implemented")
+}
+
+func (v *structRefSlice) Index(i int) structPointer {
+	panic("not implemented")
+}

vendor/github.com/gogo/protobuf/proto/pointer_unsafe.go

@@ -29,7 +29,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// +build !appengine
+// +build !appengine,!js
 
 // This file contains the implementation of the proto field accesses using package unsafe.
 
@@ -126,6 +126,10 @@ func structPointer_StringSlice(p structPointer, f field) *[]string {
 }
 
 // ExtMap returns the address of an extension map field in the struct.
+func structPointer_Extensions(p structPointer, f field) *XXX_InternalExtensions {
+	return (*XXX_InternalExtensions)(unsafe.Pointer(uintptr(p) + uintptr(f)))
+}
+
 func structPointer_ExtMap(p structPointer, f field) *map[int32]Extension {
 	return (*map[int32]Extension)(unsafe.Pointer(uintptr(p) + uintptr(f)))
 }

vendor/github.com/gogo/protobuf/proto/pointer_unsafe_gogo.go

@@ -1,5 +1,7 @@
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -24,7 +26,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// +build !appengine
+// +build !appengine,!js
 
 // This file contains the implementation of the proto field accesses using package unsafe.
 
@@ -70,16 +72,13 @@ func structPointer_Copy(oldptr structPointer, newptr structPointer, size int) {
 
 func appendStructPointer(base structPointer, f field, typ reflect.Type) structPointer {
 	size := typ.Elem().Size()
-	oldHeader := structPointer_GetSliceHeader(base, f)
-	newLen := oldHeader.Len + 1
-	slice := reflect.MakeSlice(typ, newLen, newLen)
-	bas := toStructPointer(slice)
-	for i := 0; i < oldHeader.Len; i++ {
-		newElemptr := uintptr(bas) + uintptr(i)*size
-		oldElemptr := oldHeader.Data + uintptr(i)*size
-		copyUintPtr(oldElemptr, newElemptr, int(size))
-	}
 
+	oldHeader := structPointer_GetSliceHeader(base, f)
+	oldSlice := reflect.NewAt(typ, unsafe.Pointer(oldHeader)).Elem()
+	newLen := oldHeader.Len + 1
+	newSlice := reflect.MakeSlice(typ, newLen, newLen)
+	reflect.Copy(newSlice, oldSlice)
+	bas := toStructPointer(newSlice)
 	oldHeader.Data = uintptr(bas)
 	oldHeader.Len = newLen
 	oldHeader.Cap = newLen
@@ -106,3 +105,24 @@ func structPointer_Add(p structPointer, size field) structPointer {
 func structPointer_Len(p structPointer, f field) int {
 	return len(*(*[]interface{})(unsafe.Pointer(structPointer_GetRefStructPointer(p, f))))
 }
+
+func structPointer_StructRefSlice(p structPointer, f field, size uintptr) *structRefSlice {
+	return &structRefSlice{p: p, f: f, size: size}
+}
+
+// A structRefSlice represents a slice of structs (themselves submessages or groups).
+type structRefSlice struct {
+	p    structPointer
+	f    field
+	size uintptr
+}
+
+func (v *structRefSlice) Len() int {
+	return structPointer_Len(v.p, v.f)
+}
+
+func (v *structRefSlice) Index(i int) structPointer {
+	ss := structPointer_GetStructPointer(v.p, v.f)
+	ss1 := structPointer_GetRefStructPointer(ss, 0)
+	return structPointer_Add(ss1, field(uintptr(i)*v.size))
+}

vendor/github.com/gogo/protobuf/proto/properties.go

@@ -1,7 +1,7 @@
-// Extensions for Protocol Buffers to create more go like structures.
+// Protocol Buffers for Go with Gadgets
 //
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Go support for Protocol Buffers - Google's data interchange format
 //
@@ -190,10 +190,11 @@ type Properties struct {
 	proto3   bool   // whether this is known to be a proto3 field; set for []byte only
 	oneof    bool   // whether this is a oneof field
 
-	Default    string // default value
-	HasDefault bool   // whether an explicit default was provided
-	CustomType string
-	def_uint64 uint64
+	Default     string // default value
+	HasDefault  bool   // whether an explicit default was provided
+	CustomType  string
+	StdTime     bool
+	StdDuration bool
 
 	enc           encoder
 	valEnc        valueEncoder // set for bool and numeric types only
@@ -340,6 +341,10 @@ func (p *Properties) Parse(s string) {
 			p.OrigName = strings.Split(f, "=")[1]
 		case strings.HasPrefix(f, "customtype="):
 			p.CustomType = strings.Split(f, "=")[1]
+		case f == "stdtime":
+			p.StdTime = true
+		case f == "stdduration":
+			p.StdDuration = true
 		}
 	}
 }
@@ -355,11 +360,22 @@ func (p *Properties) setEncAndDec(typ reflect.Type, f *reflect.StructField, lock
 	p.enc = nil
 	p.dec = nil
 	p.size = nil
-	if len(p.CustomType) > 0 {
+	isMap := typ.Kind() == reflect.Map
+	if len(p.CustomType) > 0 && !isMap {
 		p.setCustomEncAndDec(typ)
 		p.setTag(lockGetProp)
 		return
 	}
+	if p.StdTime && !isMap {
+		p.setTimeEncAndDec(typ)
+		p.setTag(lockGetProp)
+		return
+	}
+	if p.StdDuration && !isMap {
+		p.setDurationEncAndDec(typ)
+		p.setTag(lockGetProp)
+		return
+	}
 	switch t1 := typ; t1.Kind() {
 	default:
 		fmt.Fprintf(os.Stderr, "proto: no coders for %v\n", t1)
@@ -542,17 +558,13 @@ func (p *Properties) setEncAndDec(typ reflect.Type, f *reflect.StructField, lock
 			p.dec = (*Buffer).dec_slice_int64
 			p.packedDec = (*Buffer).dec_slice_packed_int64
 		case reflect.Uint8:
-			p.enc = (*Buffer).enc_slice_byte
 			p.dec = (*Buffer).dec_slice_byte
-			p.size = size_slice_byte
-			// This is a []byte, which is either a bytes field,
-			// or the value of a map field. In the latter case,
-			// we always encode an empty []byte, so we should not
-			// use the proto3 enc/size funcs.
-			// f == nil iff this is the key/value of a map field.
-			if p.proto3 && f != nil {
+			if p.proto3 {
 				p.enc = (*Buffer).enc_proto3_slice_byte
 				p.size = size_proto3_slice_byte
+			} else {
+				p.enc = (*Buffer).enc_slice_byte
+				p.size = size_slice_byte
 			}
 		case reflect.Float32, reflect.Float64:
 			switch t2.Bits() {
@@ -634,6 +646,10 @@ func (p *Properties) setEncAndDec(typ reflect.Type, f *reflect.StructField, lock
 			// so we need encoders for the pointer to this type.
 			vtype = reflect.PtrTo(vtype)
 		}
+
+		p.mvalprop.CustomType = p.CustomType
+		p.mvalprop.StdDuration = p.StdDuration
+		p.mvalprop.StdTime = p.StdTime
 		p.mvalprop.init(vtype, "Value", f.Tag.Get("protobuf_val"), nil, lockGetProp)
 	}
 	p.setTag(lockGetProp)
@@ -744,7 +760,9 @@ func getPropertiesLocked(t reflect.Type) *StructProperties {
 	propertiesMap[t] = prop
 
 	// build properties
-	prop.extendable = reflect.PtrTo(t).Implements(extendableProtoType)
+	prop.extendable = reflect.PtrTo(t).Implements(extendableProtoType) ||
+		reflect.PtrTo(t).Implements(extendableProtoV1Type) ||
+		reflect.PtrTo(t).Implements(extendableBytesType)
 	prop.unrecField = invalidField
 	prop.Prop = make([]*Properties, t.NumField())
 	prop.order = make([]int, t.NumField())
@@ -756,7 +774,11 @@ func getPropertiesLocked(t reflect.Type) *StructProperties {
 		name := f.Name
 		p.init(f.Type, name, f.Tag.Get("protobuf"), &f, false)
 
-		if f.Name == "XXX_extensions" { // special case
+		if f.Name == "XXX_InternalExtensions" { // special case
+			p.enc = (*Buffer).enc_exts
+			p.dec = nil // not needed
+			p.size = size_exts
+		} else if f.Name == "XXX_extensions" { // special case
 			if len(f.Tag.Get("protobuf")) > 0 {
 				p.enc = (*Buffer).enc_ext_slice_byte
 				p.dec = nil // not needed
@@ -766,13 +788,14 @@ func getPropertiesLocked(t reflect.Type) *StructProperties {
 				p.dec = nil // not needed
 				p.size = size_map
 			}
-		}
-		if f.Name == "XXX_unrecognized" { // special case
+		} else if f.Name == "XXX_unrecognized" { // special case
 			prop.unrecField = toField(&f)
 		}
-		oneof := f.Tag.Get("protobuf_oneof") != "" // special case
-		if oneof {
+		oneof := f.Tag.Get("protobuf_oneof") // special case
+		if oneof != "" {
 			isOneofMessage = true
+			// Oneof fields don't use the traditional protobuf tag.
+			p.OrigName = oneof
 		}
 		prop.Prop[i] = p
 		prop.order[i] = i
@@ -783,7 +806,7 @@ func getPropertiesLocked(t reflect.Type) *StructProperties {
 			}
 			print("\n")
 		}
-		if p.enc == nil && !strings.HasPrefix(f.Name, "XXX_") && !oneof {
+		if p.enc == nil && !strings.HasPrefix(f.Name, "XXX_") && oneof == "" {
 			fmt.Fprintln(os.Stderr, "proto: no encoder for", f.Name, f.Type.String(), "[GetProperties]")
 		}
 	}
@@ -917,7 +940,29 @@ func RegisterType(x Message, name string) {
 }
 
 // MessageName returns the fully-qualified proto name for the given message type.
-func MessageName(x Message) string { return revProtoTypes[reflect.TypeOf(x)] }
+func MessageName(x Message) string {
+	type xname interface {
+		XXX_MessageName() string
+	}
+	if m, ok := x.(xname); ok {
+		return m.XXX_MessageName()
+	}
+	return revProtoTypes[reflect.TypeOf(x)]
+}
 
 // MessageType returns the message type (pointer to struct) for a named message.
 func MessageType(name string) reflect.Type { return protoTypes[name] }
+
+// A registry of all linked proto files.
+var (
+	protoFiles = make(map[string][]byte) // file name => fileDescriptor
+)
+
+// RegisterFile is called from generated code and maps from the
+// full file name of a .proto file to its compressed FileDescriptorProto.
+func RegisterFile(filename string, fileDescriptor []byte) {
+	protoFiles[filename] = fileDescriptor
+}
+
+// FileDescriptor returns the compressed FileDescriptorProto for a .proto file.
+func FileDescriptor(filename string) []byte { return protoFiles[filename] }

vendor/github.com/gogo/protobuf/proto/properties_gogo.go

@@ -1,5 +1,7 @@
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -49,6 +51,51 @@ func (p *Properties) setCustomEncAndDec(typ reflect.Type) {
 	}
 }
 
+func (p *Properties) setDurationEncAndDec(typ reflect.Type) {
+	if p.Repeated {
+		if typ.Elem().Kind() == reflect.Ptr {
+			p.enc = (*Buffer).enc_slice_duration
+			p.dec = (*Buffer).dec_slice_duration
+			p.size = size_slice_duration
+		} else {
+			p.enc = (*Buffer).enc_slice_ref_duration
+			p.dec = (*Buffer).dec_slice_ref_duration
+			p.size = size_slice_ref_duration
+		}
+	} else if typ.Kind() == reflect.Ptr {
+		p.enc = (*Buffer).enc_duration
+		p.dec = (*Buffer).dec_duration
+		p.size = size_duration
+	} else {
+		p.enc = (*Buffer).enc_ref_duration
+		p.dec = (*Buffer).dec_ref_duration
+		p.size = size_ref_duration
+	}
+}
+
+func (p *Properties) setTimeEncAndDec(typ reflect.Type) {
+	if p.Repeated {
+		if typ.Elem().Kind() == reflect.Ptr {
+			p.enc = (*Buffer).enc_slice_time
+			p.dec = (*Buffer).dec_slice_time
+			p.size = size_slice_time
+		} else {
+			p.enc = (*Buffer).enc_slice_ref_time
+			p.dec = (*Buffer).dec_slice_ref_time
+			p.size = size_slice_ref_time
+		}
+	} else if typ.Kind() == reflect.Ptr {
+		p.enc = (*Buffer).enc_time
+		p.dec = (*Buffer).dec_time
+		p.size = size_time
+	} else {
+		p.enc = (*Buffer).enc_ref_time
+		p.dec = (*Buffer).dec_ref_time
+		p.size = size_ref_time
+	}
+
+}
+
 func (p *Properties) setSliceOfNonPointerStructs(typ reflect.Type) {
 	t2 := typ.Elem()
 	p.sstype = typ

vendor/github.com/gogo/protobuf/proto/skip_gogo.go

@@ -1,5 +1,7 @@
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are

vendor/github.com/gogo/protobuf/proto/text.go

@@ -1,7 +1,7 @@
-// Extensions for Protocol Buffers to create more go like structures.
+// Protocol Buffers for Go with Gadgets
 //
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Go support for Protocol Buffers - Google's data interchange format
 //
@@ -50,6 +50,8 @@ import (
 	"reflect"
 	"sort"
 	"strings"
+	"sync"
+	"time"
 )
 
 var (
@@ -159,7 +161,7 @@ func (w *textWriter) indent() { w.ind++ }
 
 func (w *textWriter) unindent() {
 	if w.ind == 0 {
-		log.Printf("proto: textWriter unindented too far")
+		log.Print("proto: textWriter unindented too far")
 		return
 	}
 	w.ind--
@@ -180,7 +182,93 @@ type raw interface {
 	Bytes() []byte
 }
 
-func writeStruct(w *textWriter, sv reflect.Value) error {
+func requiresQuotes(u string) bool {
+	// When type URL contains any characters except [0-9A-Za-z./\-]*, it must be quoted.
+	for _, ch := range u {
+		switch {
+		case ch == '.' || ch == '/' || ch == '_':
+			continue
+		case '0' <= ch && ch <= '9':
+			continue
+		case 'A' <= ch && ch <= 'Z':
+			continue
+		case 'a' <= ch && ch <= 'z':
+			continue
+		default:
+			return true
+		}
+	}
+	return false
+}
+
+// isAny reports whether sv is a google.protobuf.Any message
+func isAny(sv reflect.Value) bool {
+	type wkt interface {
+		XXX_WellKnownType() string
+	}
+	t, ok := sv.Addr().Interface().(wkt)
+	return ok && t.XXX_WellKnownType() == "Any"
+}
+
+// writeProto3Any writes an expanded google.protobuf.Any message.
+//
+// It returns (false, nil) if sv value can't be unmarshaled (e.g. because
+// required messages are not linked in).
+//
+// It returns (true, error) when sv was written in expanded format or an error
+// was encountered.
+func (tm *TextMarshaler) writeProto3Any(w *textWriter, sv reflect.Value) (bool, error) {
+	turl := sv.FieldByName("TypeUrl")
+	val := sv.FieldByName("Value")
+	if !turl.IsValid() || !val.IsValid() {
+		return true, errors.New("proto: invalid google.protobuf.Any message")
+	}
+
+	b, ok := val.Interface().([]byte)
+	if !ok {
+		return true, errors.New("proto: invalid google.protobuf.Any message")
+	}
+
+	parts := strings.Split(turl.String(), "/")
+	mt := MessageType(parts[len(parts)-1])
+	if mt == nil {
+		return false, nil
+	}
+	m := reflect.New(mt.Elem())
+	if err := Unmarshal(b, m.Interface().(Message)); err != nil {
+		return false, nil
+	}
+	w.Write([]byte("["))
+	u := turl.String()
+	if requiresQuotes(u) {
+		writeString(w, u)
+	} else {
+		w.Write([]byte(u))
+	}
+	if w.compact {
+		w.Write([]byte("]:<"))
+	} else {
+		w.Write([]byte("]: <\n"))
+		w.ind++
+	}
+	if err := tm.writeStruct(w, m.Elem()); err != nil {
+		return true, err
+	}
+	if w.compact {
+		w.Write([]byte("> "))
+	} else {
+		w.ind--
+		w.Write([]byte(">\n"))
+	}
+	return true, nil
+}
+
+func (tm *TextMarshaler) writeStruct(w *textWriter, sv reflect.Value) error {
+	if tm.ExpandAny && isAny(sv) {
+		if canExpand, err := tm.writeProto3Any(w, sv); canExpand {
+			return err
+		}
+	}
 	st := sv.Type()
 	sprops := GetProperties(st)
 	for i := 0; i < sv.NumField(); i++ {
@@ -233,10 +321,10 @@ func writeStruct(w *textWriter, sv reflect.Value) error {
 					continue
 				}
 				if len(props.Enum) > 0 {
-					if err := writeEnum(w, v, props); err != nil {
+					if err := tm.writeEnum(w, v, props); err != nil {
 						return err
 					}
-				} else if err := writeAny(w, v, props); err != nil {
+				} else if err := tm.writeAny(w, v, props); err != nil {
 					return err
 				}
 				if err := w.WriteByte('\n'); err != nil {
@@ -278,7 +366,7 @@ func writeStruct(w *textWriter, sv reflect.Value) error {
 						return err
 					}
 				}
-				if err := writeAny(w, key, props.mkeyprop); err != nil {
+				if err := tm.writeAny(w, key, props.mkeyprop); err != nil {
 					return err
 				}
 				if err := w.WriteByte('\n'); err != nil {
@@ -295,7 +383,7 @@ func writeStruct(w *textWriter, sv reflect.Value) error {
 							return err
 						}
 					}
-					if err := writeAny(w, val, props.mvalprop); err != nil {
+					if err := tm.writeAny(w, val, props.mvalprop); err != nil {
 						return err
 					}
 					if err := w.WriteByte('\n'); err != nil {
@@ -367,10 +455,10 @@ func writeStruct(w *textWriter, sv reflect.Value) error {
 		}
 
 		if len(props.Enum) > 0 {
-			if err := writeEnum(w, fv, props); err != nil {
+			if err := tm.writeEnum(w, fv, props); err != nil {
 				return err
 			}
-		} else if err := writeAny(w, fv, props); err != nil {
+		} else if err := tm.writeAny(w, fv, props); err != nil {
 			return err
 		}
 
@@ -387,8 +475,8 @@ func writeStruct(w *textWriter, sv reflect.Value) error {
 		pv = reflect.New(sv.Type())
 		pv.Elem().Set(sv)
 	}
-	if pv.Type().Implements(extendableProtoType) {
-		if err := writeExtensions(w, pv); err != nil {
+	if pv.Type().Implements(extensionRangeType) {
+		if err := tm.writeExtensions(w, pv); err != nil {
 			return err
 		}
 	}
@@ -418,20 +506,45 @@ func writeRaw(w *textWriter, b []byte) error {
 }
 
 // writeAny writes an arbitrary field.
-func writeAny(w *textWriter, v reflect.Value, props *Properties) error {
+func (tm *TextMarshaler) writeAny(w *textWriter, v reflect.Value, props *Properties) error {
 	v = reflect.Indirect(v)
 
-	if props != nil && len(props.CustomType) > 0 {
-		custom, ok := v.Interface().(Marshaler)
-		if ok {
-			data, err := custom.Marshal()
+	if props != nil {
+		if len(props.CustomType) > 0 {
+			custom, ok := v.Interface().(Marshaler)
+			if ok {
+				data, err := custom.Marshal()
+				if err != nil {
+					return err
+				}
+				if err := writeString(w, string(data)); err != nil {
+					return err
+				}
+				return nil
+			}
+		} else if props.StdTime {
+			t, ok := v.Interface().(time.Time)
+			if !ok {
+				return fmt.Errorf("stdtime is not time.Time, but %T", v.Interface())
+			}
+			tproto, err := timestampProto(t)
 			if err != nil {
 				return err
 			}
-			if err := writeString(w, string(data)); err != nil {
-				return err
+			props.StdTime = false
+			err = tm.writeAny(w, reflect.ValueOf(tproto), props)
+			props.StdTime = true
+			return err
+		} else if props.StdDuration {
+			d, ok := v.Interface().(time.Duration)
+			if !ok {
+				return fmt.Errorf("stdtime is not time.Duration, but %T", v.Interface())
 			}
-			return nil
+			dproto := durationProto(d)
+			props.StdDuration = false
+			err := tm.writeAny(w, reflect.ValueOf(dproto), props)
+			props.StdDuration = true
+			return err
 		}
 	}
 
@@ -481,15 +594,15 @@ func writeAny(w *textWriter, v reflect.Value, props *Properties) error {
 			}
 		}
 		w.indent()
-		if tm, ok := v.Interface().(encoding.TextMarshaler); ok {
-			text, err := tm.MarshalText()
+		if etm, ok := v.Interface().(encoding.TextMarshaler); ok {
+			text, err := etm.MarshalText()
 			if err != nil {
 				return err
 			}
 			if _, err = w.Write(text); err != nil {
 				return err
 			}
-		} else if err := writeStruct(w, v); err != nil {
+		} else if err := tm.writeStruct(w, v); err != nil {
 			return err
 		}
 		w.unindent()
@@ -633,30 +746,39 @@ func (s int32Slice) Swap(i, j int)      { s[i], s[j] = s[j], s[i] }
 
 // writeExtensions writes all the extensions in pv.
 // pv is assumed to be a pointer to a protocol message struct that is extendable.
-func writeExtensions(w *textWriter, pv reflect.Value) error {
+func (tm *TextMarshaler) writeExtensions(w *textWriter, pv reflect.Value) error {
 	emap := extensionMaps[pv.Type().Elem()]
-	ep := pv.Interface().(extendableProto)
+	e := pv.Interface().(Message)
 
-	// Order the extensions by ID.
-	// This isn't strictly necessary, but it will give us
-	// canonical output, which will also make testing easier.
 	var m map[int32]Extension
-	if em, ok := ep.(extensionsMap); ok {
-		m = em.ExtensionMap()
-	} else if em, ok := ep.(extensionsBytes); ok {
+	var mu sync.Locker
+	if em, ok := e.(extensionsBytes); ok {
 		eb := em.GetExtensions()
 		var err error
 		m, err = BytesToExtensionsMap(*eb)
 		if err != nil {
 			return err
 		}
+		mu = notLocker{}
+	} else if _, ok := e.(extendableProto); ok {
+		ep, _ := extendable(e)
+		m, mu = ep.extensionsRead()
+		if m == nil {
+			return nil
+		}
 	}
 
+	// Order the extensions by ID.
+	// This isn't strictly necessary, but it will give us
+	// canonical output, which will also make testing easier.
+
+	mu.Lock()
 	ids := make([]int32, 0, len(m))
 	for id := range m {
 		ids = append(ids, id)
 	}
 	sort.Sort(int32Slice(ids))
+	mu.Unlock()
 
 	for _, extNum := range ids {
 		ext := m[extNum]
@@ -672,20 +794,20 @@ func writeExtensions(w *textWriter, pv reflect.Value) error {
 			continue
 		}
 
-		pb, err := GetExtension(ep, desc)
+		pb, err := GetExtension(e, desc)
 		if err != nil {
 			return fmt.Errorf("failed getting extension: %v", err)
 		}
 
 		// Repeated extensions will appear as a slice.
 		if !desc.repeated() {
-			if err := writeExtension(w, desc.Name, pb); err != nil {
+			if err := tm.writeExtension(w, desc.Name, pb); err != nil {
 				return err
 			}
 		} else {
 			v := reflect.ValueOf(pb)
 			for i := 0; i < v.Len(); i++ {
-				if err := writeExtension(w, desc.Name, v.Index(i).Interface()); err != nil {
+				if err := tm.writeExtension(w, desc.Name, v.Index(i).Interface()); err != nil {
 					return err
 				}
 			}
@@ -694,7 +816,7 @@ func writeExtensions(w *textWriter, pv reflect.Value) error {
 	return nil
 }
 
-func writeExtension(w *textWriter, name string, pb interface{}) error {
+func (tm *TextMarshaler) writeExtension(w *textWriter, name string, pb interface{}) error {
 	if _, err := fmt.Fprintf(w, "[%s]:", name); err != nil {
 		return err
 	}
@@ -703,7 +825,7 @@ func writeExtension(w *textWriter, name string, pb interface{}) error {
 			return err
 		}
 	}
-	if err := writeAny(w, reflect.ValueOf(pb), nil); err != nil {
+	if err := tm.writeAny(w, reflect.ValueOf(pb), nil); err != nil {
 		return err
 	}
 	if err := w.WriteByte('\n'); err != nil {
@@ -730,12 +852,13 @@ func (w *textWriter) writeIndent() {
 
 // TextMarshaler is a configurable text format marshaler.
 type TextMarshaler struct {
-	Compact bool // use compact text format (one line).
+	Compact   bool // use compact text format (one line).
+	ExpandAny bool // expand google.protobuf.Any messages of known types
 }
 
 // Marshal writes a given protocol buffer in text format.
 // The only errors returned are from w.
-func (m *TextMarshaler) Marshal(w io.Writer, pb Message) error {
+func (tm *TextMarshaler) Marshal(w io.Writer, pb Message) error {
 	val := reflect.ValueOf(pb)
 	if pb == nil || val.IsNil() {
 		w.Write([]byte("<nil>"))
@@ -750,11 +873,11 @@ func (m *TextMarshaler) Marshal(w io.Writer, pb Message) error {
 	aw := &textWriter{
 		w:        ww,
 		complete: true,
-		compact:  m.Compact,
+		compact:  tm.Compact,
 	}
 
-	if tm, ok := pb.(encoding.TextMarshaler); ok {
-		text, err := tm.MarshalText()
+	if etm, ok := pb.(encoding.TextMarshaler); ok {
+		text, err := etm.MarshalText()
 		if err != nil {
 			return err
 		}
@@ -768,7 +891,7 @@ func (m *TextMarshaler) Marshal(w io.Writer, pb Message) error {
 	}
 	// Dereference the received pointer so we don't have outer < and >.
 	v := reflect.Indirect(val)
-	if err := writeStruct(aw, v); err != nil {
+	if err := tm.writeStruct(aw, v); err != nil {
 		return err
 	}
 	if bw != nil {
@@ -778,9 +901,9 @@ func (m *TextMarshaler) Marshal(w io.Writer, pb Message) error {
 }
 
 // Text is the same as Marshal, but returns the string directly.
-func (m *TextMarshaler) Text(pb Message) string {
+func (tm *TextMarshaler) Text(pb Message) string {
 	var buf bytes.Buffer
-	m.Marshal(&buf, pb)
+	tm.Marshal(&buf, pb)
 	return buf.String()
 }
 

vendor/github.com/gogo/protobuf/proto/text_gogo.go

@@ -1,5 +1,7 @@
-// Copyright (c) 2013, Vastech SA (PTY) LTD. All rights reserved.
-// http://github.com/gogo/protobuf/gogoproto
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
@@ -31,10 +33,10 @@ import (
 	"reflect"
 )
 
-func writeEnum(w *textWriter, v reflect.Value, props *Properties) error {
+func (tm *TextMarshaler) writeEnum(w *textWriter, v reflect.Value, props *Properties) error {
 	m, ok := enumStringMaps[props.Enum]
 	if !ok {
-		if err := writeAny(w, v, props); err != nil {
+		if err := tm.writeAny(w, v, props); err != nil {
 			return err
 		}
 	}
@@ -46,7 +48,7 @@ func writeEnum(w *textWriter, v reflect.Value, props *Properties) error {
 	}
 	s, ok := m[key]
 	if !ok {
-		if err := writeAny(w, v, props); err != nil {
+		if err := tm.writeAny(w, v, props); err != nil {
 			return err
 		}
 	}