internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: googleapis/google-auth-library-python

Issue:
Set the default request timeout to something other than `None`
The [AuthorizedSession.requests()](https://github.com/googleapis/google-auth-library-python/blob/1b9de8dfbe4523f3170e47985ab523cb7865de48/google/auth/transport/requests.py#L242-L251) method does not specify a default timeout.

Since production code would almost always want to have some sort of a timeout, let's add one. The libraries that rely on `google-auth`, but do (yet) not specify a timeout themselves, would benefit from that.

Example: [storage issue](https://github.com/googleapis/google-cloud-python/issues/10182)



Discussion:

Resolving patch:
diff --git a/google/auth/transport/requests.py b/google/auth/transport/requests.py
--- a/google/auth/transport/requests.py
+++ b/google/auth/transport/requests.py
@@ -42,6 +42,8 @@
 
 _LOGGER = logging.getLogger(__name__)
 
+_DEFAULT_TIMEOUT = 120  # in seconds
+
 
 class _Response(transport.Response):
     """Requests transport response adapter.
@@ -141,7 +143,13 @@ def __init__(self, session=None):
         self.session = session
 
     def __call__(
-        self, url, method="GET", body=None, headers=None, timeout=120, **kwargs
+        self,
+        url,
+        method="GET",
+        body=None,
+        headers=None,
+        timeout=_DEFAULT_TIMEOUT,
+        **kwargs
     ):
         """Make an HTTP request using requests.
 
@@ -246,7 +254,7 @@ def request(
         data=None,
         headers=None,
         max_allowed_time=None,
-        timeout=None,
+        timeout=_DEFAULT_TIMEOUT,
         **kwargs
     ):
         """Implementation of Requests' request.


Test patch:
diff --git a/tests/transport/test_requests.py b/tests/transport/test_requests.py
--- a/tests/transport/test_requests.py
+++ b/tests/transport/test_requests.py
@@ -177,6 +177,21 @@ def test_constructor_with_auth_request(self):
 
         assert authed_session._auth_request == auth_request
 
+    def test_request_default_timeout(self):
+        credentials = mock.Mock(wraps=CredentialsStub())
+        response = make_response()
+        adapter = AdapterStub([response])
+
+        authed_session = google.auth.transport.requests.AuthorizedSession(credentials)
+        authed_session.mount(self.TEST_URL, adapter)
+
+        patcher = mock.patch("google.auth.transport.requests.requests.Session.request")
+        with patcher as patched_request:
+            authed_session.request("GET", self.TEST_URL)
+
+        expected_timeout = google.auth.transport.requests._DEFAULT_TIMEOUT
+        assert patched_request.call_args.kwargs.get("timeout") == expected_timeout
+
     def test_request_no_refresh(self):
         credentials = mock.Mock(wraps=CredentialsStub())
         response = make_response()
Repository: googleapis/google-auth-library-python

Issue:
Add support for Python 3.8



Discussion:

Resolving patch:
diff --git a/noxfile.py b/noxfile.py
--- a/noxfile.py
+++ b/noxfile.py
@@ -64,7 +64,7 @@ def blacken(session):
     session.run("black", *BLACK_PATHS)
 
 
-@nox.session(python=["2.7", "3.5", "3.6", "3.7"])
+@nox.session(python=["2.7", "3.5", "3.6", "3.7", "3.8"])
 def unit(session):
     session.install(*TEST_DEPENDENCIES)
     session.install(".")
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -56,6 +56,7 @@
         "Programming Language :: Python :: 3.5",
         "Programming Language :: Python :: 3.6",
         "Programming Language :: Python :: 3.7",
+        "Programming Language :: Python :: 3.8",
         "Development Status :: 5 - Production/Stable",
         "Intended Audience :: Developers",
         "License :: OSI Approved :: Apache Software License",


Test patch:
Repository: googleapis/google-auth-library-python

Issue:
Use extra for asyncio dependencies
Hello!  The latest release for this library pulls in aiohttp and its dependencies unconditionally, which adds non-trivial burden to projects that don’t need it.  Would you consider using a packaging extra so that people can opt-in?


Discussion:
That sounds alright to me. @crwilcox?
I think that's reasonable. Maybe we will want to use the same approach for there other asyncio/aiohttp packages

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -27,9 +27,9 @@
     'rsa>=3.1.4,<5; python_version >= "3.5"',
     "setuptools>=40.3.0",
     "six>=1.9.0",
-    'aiohttp >= 3.6.2, < 4.0.0dev; python_version>="3.6"',
 )
 
+extras = {"aiohttp": "aiohttp >= 3.6.2, < 4.0.0dev; python_version>='3.6'"}
 
 with io.open("README.rst", "r") as fh:
     long_description = fh.read()
@@ -47,6 +47,7 @@
     packages=find_packages(exclude=("tests*", "system_tests*")),
     namespace_packages=("google",),
     install_requires=DEPENDENCIES,
+    extras_require=extras,
     python_requires=">=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*",
     license="Apache 2.0",
     keywords="google auth oauth client",


Test patch:
Repository: googleapis/google-auth-library-python

Issue:
Tests broken on Python < 3.8
```python
_______ ERROR collecting tests_async/transport/test_aiohttp_requests.py ________
ImportError while importing test module '/home/tseaver/projects/agendaless/Google/src/google-auth/tests_async/transport/test_aiohttp_requests.py'.
Hint: make sure your test modules/packages have valid Python names.
Traceback:
.nox/unit-3-6/lib/python3.6/site-packages/aioresponses/compat.py:14: in <module>
    from unittest import IsolatedAsyncioTestCase, skipIf
E   ImportError: cannot import name 'IsolatedAsyncioTestCase'

During handling of the above exception, another exception occurred:
/opt/Python-3.6.10/lib/python3.6/importlib/__init__.py:126: in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
tests_async/transport/test_aiohttp_requests.py:16: in <module>
    from aioresponses import aioresponses, core
.nox/unit-3-6/lib/python3.6/site-packages/aioresponses/__init__.py:2: in <module>
    from .core import CallbackResult, aioresponses
.nox/unit-3-6/lib/python3.6/site-packages/aioresponses/core.py:23: in <module>
    from .compat import (
.nox/unit-3-6/lib/python3.6/site-packages/aioresponses/compat.py:29: in <module>
    from asynctest import fail_on, skipIf
E   ModuleNotFoundError: No module named 'asynctest'
```

Due to https://github.com/pnuckowski/aioresponses/issues/172


Discussion:

Resolving patch:
diff --git a/noxfile.py b/noxfile.py
--- a/noxfile.py
+++ b/noxfile.py
@@ -30,7 +30,7 @@
     "grpcio",
 ]
 
-ASYNC_DEPENDENCIES = ["pytest-asyncio", "aioresponses"]
+ASYNC_DEPENDENCIES = ["pytest-asyncio", "aioresponses", "asynctest"]
 
 BLACK_VERSION = "black==19.3b0"
 BLACK_PATHS = [
@@ -144,6 +144,7 @@ def docs(session):
 @nox.session(python="pypy")
 def pypy(session):
     session.install(*TEST_DEPENDENCIES)
+    session.install(*ASYNC_DEPENDENCIES)
     session.install(".")
     session.run(
         "pytest",


Test patch:
Repository: googleapis/google-auth-library-python

Issue:
docs type
https://github.com/googleapis/google-auth-library-python/blob/41599ae932db31cf692d2c7bec15d8bb1778ab50/google/auth/impersonated_credentials.py#L151

Example has extra c and should read `from google.oauth2 import service_account`


Discussion:

Resolving patch:
diff --git a/google/auth/impersonated_credentials.py b/google/auth/impersonated_credentials.py
--- a/google/auth/impersonated_credentials.py
+++ b/google/auth/impersonated_credentials.py
@@ -148,7 +148,7 @@ class Credentials(credentials.CredentialsWithQuotaProject, credentials.Signing):
     Initialize a source credential which does not have access to
     list bucket::
 
-        from google.oauth2 import service_acccount
+        from google.oauth2 import service_account
 
         target_scopes = [
             'https://www.googleapis.com/auth/devstorage.read_only']


Test patch:
Repository: googleapis/google-auth-library-python

Issue:
Add support for Python 3.9



Discussion:

Resolving patch:
diff --git a/noxfile.py b/noxfile.py
--- a/noxfile.py
+++ b/noxfile.py
@@ -75,7 +75,7 @@ def blacken(session):
     session.run("black", *BLACK_PATHS)
 
 
-@nox.session(python=["3.6", "3.7", "3.8"])
+@nox.session(python=["3.6", "3.7", "3.8", "3.9"])
 def unit(session):
     session.install(*TEST_DEPENDENCIES)
     session.install(*(ASYNC_DEPENDENCIES))
@@ -90,7 +90,7 @@ def unit(session):
     )
 
 
-@nox.session(python=["2.7", "3.5"])
+@nox.session(python=["2.7"])
 def unit_prev_versions(session):
     session.install(*TEST_DEPENDENCIES)
     session.install(".")
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -23,8 +23,8 @@
     "pyasn1-modules>=0.2.1",
     # rsa==4.5 is the last version to support 2.7
     # https://github.com/sybrenstuvel/python-rsa/issues/152#issuecomment-643470233
-    'rsa<4.6; python_version < "3.5"',
-    'rsa>=3.1.4,<5; python_version >= "3.5"',
+    'rsa<4.6; python_version < "3.6"',
+    'rsa>=3.1.4,<5; python_version >= "3.6"',
     "setuptools>=40.3.0",
     "six>=1.9.0",
 )
@@ -48,17 +48,17 @@
     namespace_packages=("google",),
     install_requires=DEPENDENCIES,
     extras_require=extras,
-    python_requires=">=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*",
+    python_requires=">=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*",
     license="Apache 2.0",
     keywords="google auth oauth client",
     classifiers=[
         "Programming Language :: Python :: 2",
         "Programming Language :: Python :: 2.7",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.5",
         "Programming Language :: Python :: 3.6",
         "Programming Language :: Python :: 3.7",
         "Programming Language :: Python :: 3.8",
+        "Programming Language :: Python :: 3.9",
         "Development Status :: 5 - Production/Stable",
         "Intended Audience :: Developers",
         "License :: OSI Approved :: Apache Software License",


Test patch:
Repository: googleapis/google-auth-library-python

Issue:
Missing pyOpenSSL Dependency
Thanks for stopping by to let us know something could be better!

**PLEASE READ**: If you have a support contract with Google, please create an issue in the [support console](https://cloud.google.com/support/) instead of filing on GitHub. This will ensure a timely response.

Please run down the following list and make sure you've tried the usual "quick fixes":

  - Search the issues already opened: https://github.com/googleapis/google-auth-library-python/issues

If you are still having issues, please be sure to include as much information as possible:

#### Environment details

  - OS:
  - Python version:
  - pip version:
  - `google-auth` version:

#### Steps to reproduce

  1. Missing pyOpenSSL dependency in setup.py

For the tests there is a requirement in https://github.com/googleapis/google-auth-library-python/blob/master/noxfile.py against pyOpenSSL. But there are imports for pyOpenSSL in multiple modules in the code. Should pyOpenSSL be added to the requirements in setup.py?

I created https://github.com/googleapis/google-auth-library-python/pull/550 with the proposal but wanted to get feedback from an issue first as I don't see this showing up in previous issues or pull requests.

Making sure to follow these steps will guarantee the quickest resolution possible.

Thanks!



Discussion:
Hi @smarlowucf,

pyOpenSSL is not a requirement as it is only required for some transports. If you are for example only using gRPC you do not need pyOpenSSL.

We could potentially add it as an [`extra`](https://setuptools.readthedocs.io/en/latest/setuptools.html#declaring-extras-optional-features-with-their-own-dependencies) to make it easier to install.
Hi @busunkim96. Okay, I agree it would be nice to have it as an extra so it's documented. I noticed it missing from running the test suite. I will close the PR.

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -29,7 +29,10 @@
     "six>=1.9.0",
 )
 
-extras = {"aiohttp": "aiohttp >= 3.6.2, < 4.0.0dev; python_version>='3.6'"}
+extras = {
+    "aiohttp": "aiohttp >= 3.6.2, < 4.0.0dev; python_version>='3.6'",
+    "pyopenssl": "pyopenssl>=20.0.0",
+}
 
 with io.open("README.rst", "r") as fh:
     long_description = fh.read()


Test patch:
Repository: googleapis/google-auth-library-python

Issue:
jwt.encode() overrides the algorithm specified by the caller
The `jwt.encode()` function always set the `alg` JWT header to either ES256 or RS256, even if the caller had specified an explicit algorithm:

https://github.com/googleapis/google-auth-library-python/blob/48e8be3d59a47493e60f5b5d9f284b300979a11c/google/auth/jwt.py#L98-L101

This function should only set the `alg` header when the caller hasn't specified one. This is required to support some use cases in Firebase emulator, where we need the ability to mint JWTs with `alg` header values like `none`.


Discussion:
It might also make sense to read the exact `alg` header to use from the `google.auth.crypt.Signer` interface, since those concepts are close related. Something like:

```py
if 'alg' not in header:
    if signer.alg:
        header['alg'] = signer.alg
    elif es256 is not None and isinstance(signer, es256.ES256Signer): 
       header.update({"alg": "ES256"}) 
    else: 
       header.update({"alg": "RS256"})
```

Let me know if this makes sense, and I'd be happy to provide a PR to this effect.
@arithmetic1728 @silvolu PTAL
Also adding @yuchenshi and @samtstern from Firebase for visibility.

Resolving patch:
diff --git a/google/auth/jwt.py b/google/auth/jwt.py
--- a/google/auth/jwt.py
+++ b/google/auth/jwt.py
@@ -95,10 +95,11 @@ def encode(signer, payload, header=None, key_id=None):
 
     header.update({"typ": "JWT"})
 
-    if es256 is not None and isinstance(signer, es256.ES256Signer):
-        header.update({"alg": "ES256"})
-    else:
-        header.update({"alg": "RS256"})
+    if "alg" not in header:
+        if es256 is not None and isinstance(signer, es256.ES256Signer):
+            header.update({"alg": "ES256"})
+        else:
+            header.update({"alg": "RS256"})
 
     if key_id is not None:
         header["kid"] = key_id


Test patch:
diff --git a/tests/test_jwt.py b/tests/test_jwt.py
--- a/tests/test_jwt.py
+++ b/tests/test_jwt.py
@@ -73,6 +73,12 @@ def test_encode_extra_headers(signer):
     }
 
 
+def test_encode_custom_alg_in_headers(signer):
+    encoded = jwt.encode(signer, {}, header={"alg": "foo"})
+    header = jwt.decode_header(encoded)
+    assert header == {"typ": "JWT", "alg": "foo", "kid": signer.key_id}
+
+
 @pytest.fixture
 def es256_signer():
     return crypt.ES256Signer.from_string(EC_PRIVATE_KEY_BYTES, "1")
Repository: googleapis/google-auth-library-python

Issue:
Silent dependency on urllib3 in _aiohttp_requests
#### Environment details

  - OS: OSX, Linux
  - Python version: 3.7
  - pip version:
  - `google-auth` version: 1.24.0

#### Steps to reproduce

  1. Setup a clean virtualenv
  2. pip install google-auth==1.24.0 aiohttp==3.5.4 (version I happen to be using)
  3. Run "from google.auth.transport import _aiohttp_requests" in a python3 session

You should get a ModuleNotFoundError for "urllib3"


Discussion:
(I see there's also a silent dependency there on `requests` - maybe you just intend for the exception on requests not being installed to go off first?)
Hey @Faqa,

Before aiohttp_requests we didn't have `urllib3` or `requests` as hard dependencies and assumed that folks would install one or both as needed after seeing one of these error messages:

https://github.com/googleapis/google-auth-library-python/blob/65074d3fbe488b95923dfa8335d071fa90bf383f/google/auth/transport/requests.py#L25-L35

https://github.com/googleapis/google-auth-library-python/blob/65074d3fbe488b95923dfa8335d071fa90bf383f/google/auth/transport/urllib3.py#L34-L45

Since `_aiohttp_requests` has a hard dependency on both I think we should just add it to the `aiohttp` extra to reduce friction.  I'll open a PR adjusting the extras. After that change if you do `pip install google-auth[aiohttp]` it should pull in all the required dependencies.

https://github.com/googleapis/google-auth-library-python/blob/65074d3fbe488b95923dfa8335d071fa90bf383f/setup.py#L32-L35

@busunkim96 Please can you take a look?

Resolving patch:
diff --git a/noxfile.py b/noxfile.py
--- a/noxfile.py
+++ b/noxfile.py
@@ -69,13 +69,14 @@ def lint(session):
     )
 
 
-@nox.session(python="3.6")
+@nox.session(python="3.8")
 def blacken(session):
     """Run black.
     Format code to uniform standard.
-    This currently uses Python 3.6 due to the automated Kokoro run of synthtool.
-    That run uses an image that doesn't have 3.6 installed. Before updating this
-    check the state of the `gcp_ubuntu_config` we use for that Kokoro run.
+    The Python version should be consistent with what is
+    supplied in the Python Owlbot postprocessor.
+
+    https://github.com/googleapis/synthtool/blob/master/docker/owlbot/python/Dockerfile
     """
     session.install(BLACK_VERSION)
     session.run("black", *BLACK_PATHS)
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -31,7 +31,11 @@
 )
 
 extras = {
-    "aiohttp": "aiohttp >= 3.6.2, < 4.0.0dev; python_version>='3.6'",
+    "aiohttp": [
+        "aiohttp >= 3.6.2, < 4.0.0dev; python_version>='3.6'",
+        "requests >= 2.18.0, < 3.0.0dev",
+        "urllib3 >= 1.0.0, <2.0.0dev",
+    ],
     "pyopenssl": "pyopenssl>=20.0.0",
     "reauth": "pyu2f>=0.1.5",
 }


Test patch:
diff --git a/testing/constraints-3.6.txt b/testing/constraints-3.6.txt
--- a/testing/constraints-3.6.txt
+++ b/testing/constraints-3.6.txt
@@ -11,4 +11,6 @@ setuptools==40.3.0
 six==1.9.0
 rsa==4.6
 rsa==3.1.4
-aiohttp==3.6.2
\ No newline at end of file
+aiohttp==3.6.2
+requests==2.18.0
+urllib3==1.0.0
Repository: googleapis/google-auth-library-python

Issue:
'testing/constraints-*.txt' not used
From #757.

In [`noxfile.py`](https://github.com/googleapis/google-auth-library-python/blob/a9234423cb2b69068fc0d30a5a0ee86a599ab8b7/noxfile.py#L87-L89), the constraints are not being used, which is why the one populated file, [`testing/constraints-3.6.txt](https://github.com/googleapis/google-auth-library-python/blob/master/testing/constraints-3.6.txt) is in an invalid state (multiple entries for `rsa`, maybe more issues).


Discussion:

Resolving patch:
diff --git a/noxfile.py b/noxfile.py
--- a/noxfile.py
+++ b/noxfile.py
@@ -12,10 +12,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import shutil
 import os
+import pathlib
+import shutil
+
 import nox
 
+CURRENT_DIRECTORY = pathlib.Path(__file__).parent.absolute()
+
 TEST_DEPENDENCIES = [
     "flask",
     "freezegun",
@@ -84,15 +88,20 @@ def blacken(session):
 
 @nox.session(python=["3.6", "3.7", "3.8", "3.9"])
 def unit(session):
-    session.install(*TEST_DEPENDENCIES)
-    session.install(*(ASYNC_DEPENDENCIES))
-    session.install(".")
+    constraints_path = str(
+        CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
+    )
+    add_constraints = ["-c", constraints_path]
+    session.install(*(TEST_DEPENDENCIES + add_constraints))
+    session.install(*(ASYNC_DEPENDENCIES + add_constraints))
+    session.install(".", *add_constraints)
     session.run(
         "pytest",
         f"--junitxml=unit_{session.python}_sponge_log.xml",
         "--cov=google.auth",
         "--cov=google.oauth2",
         "--cov=tests",
+        "--cov-report=term-missing",
         "tests",
         "tests_async",
     )
@@ -123,7 +132,7 @@ def cover(session):
         "--cov=google.oauth2",
         "--cov=tests",
         "--cov=tests_async",
-        "--cov-report=",
+        "--cov-report=term-missing",
         "tests",
         "tests_async",
     )
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -33,8 +33,7 @@
 extras = {
     "aiohttp": [
         "aiohttp >= 3.6.2, < 4.0.0dev; python_version>='3.6'",
-        "requests >= 2.18.0, < 3.0.0dev",
-        "urllib3 >= 1.0.0, <2.0.0dev",
+        "requests >= 2.20.0, < 3.0.0dev",
     ],
     "pyopenssl": "pyopenssl>=20.0.0",
     "reauth": "pyu2f>=0.1.5",


Test patch:
diff --git a/testing/constraints-3.6.txt b/testing/constraints-3.6.txt
--- a/testing/constraints-3.6.txt
+++ b/testing/constraints-3.6.txt
@@ -9,8 +9,6 @@ cachetools==2.0.0
 pyasn1-modules==0.2.1
 setuptools==40.3.0
 six==1.9.0
-rsa==4.6
 rsa==3.1.4
 aiohttp==3.6.2
-requests==2.18.0
-urllib3==1.0.0
+requests==2.20.0
Repository: googleapis/google-auth-library-python

Issue:
Move system tests into a separate Kokoro build
At the moment, we run the system tests [at the end of *every* Kokoro build](https://github.com/googleapis/google-auth-library-python/blob/da8bb13c1349e771ffc2e125256030495c53d956/.kokoro/build.sh#L57-L63).  Not only should we *not* be running them during e.g. the `docs-presubmit` build, we should also run them separately from the `unit` / `cover` / `lint` sessions, so that we parallelize the long-running systests.


Discussion:

Resolving patch:
diff --git a/owlbot.py b/owlbot.py
--- a/owlbot.py
+++ b/owlbot.py
@@ -13,7 +13,6 @@
     templated_files / ".kokoro",
     excludes=[
         "continuous/common.cfg",
-        "docs/common.cfg",
         "presubmit/common.cfg",
         "build.sh",
     ],
@@ -26,20 +25,4 @@
     'value: "docs"',
 )
 
-assert 1 == s.replace(
-    ".kokoro/docker/docs/Dockerfile",
-    """\
-CMD \["python3\.8"\]""",
-    """\
-# Install gcloud SDK
-RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | \\
-    tee -a /etc/apt/sources.list.d/google-cloud-sdk.list \\
-  && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | \\
-    apt-key --keyring /usr/share/keyrings/cloud.google.gpg  add - \\
-  && apt-get update -y \\
-  && apt-get install python2 google-cloud-sdk -y
-
-CMD ["python3.8"]""",
-)
-
 s.shell.run(["nox", "-s", "blacken"], hide_output=False)


Test patch:
Repository: googleapis/google-auth-library-python

Issue:
JWT decoding depends upon deprecated function
#### Environment details

  - OS: Debian 11 (bullseye)
  - Python version: 3.9.2
  - pip version: 20.3.4
  - `google-auth` version: 1.30

#### Steps to reproduce

Decode a JWT token from Google Cloud Identity-Aware Proxy

#### Error

The following deprecation warnings are issues from the `cryptography` library:

```
/usr/local/lib/python3.9/dist-packages/google/auth/crypt/es256.py:56: CryptographyDeprecationWarning: int_from_bytes is deprecated, use int.from_bytes instead
/usr/local/lib/python3.9/dist-packages/google/auth/crypt/es256.py:57: CryptographyDeprecationWarning: int_from_bytes is deprecated, use int.from_bytes instead
```

The changes necessary seem self evident. The [function in question][frombytes] exists in Python 3.2+ and therefore falls within the currently stated supported versions (3.5+).

[frombytes]: https://docs.python.org/3/library/stdtypes.html#int.from_bytes


Discussion:

Resolving patch:
diff --git a/google/auth/crypt/es256.py b/google/auth/crypt/es256.py
--- a/google/auth/crypt/es256.py
+++ b/google/auth/crypt/es256.py
@@ -53,8 +53,8 @@ def verify(self, message, signature):
         sig_bytes = _helpers.to_bytes(signature)
         if len(sig_bytes) != 64:
             return False
-        r = utils.int_from_bytes(sig_bytes[:32], byteorder="big")
-        s = utils.int_from_bytes(sig_bytes[32:], byteorder="big")
+        r = int.from_bytes(sig_bytes[:32], byteorder="big")
+        s = int.from_bytes(sig_bytes[32:], byteorder="big")
         asn1_sig = encode_dss_signature(r, s)
 
         message = _helpers.to_bytes(message)


Test patch:
diff --git a/system_tests/secrets.tar.enc b/system_tests/secrets.tar.enc
Binary files a/system_tests/secrets.tar.enc and b/system_tests/secrets.tar.enc differ