mitchellh/packer — pull request #1679 by evandbrown (2014-11-18 23:47:30+00:00)
Title: Use golang/oauth2, no longer require client_secrets.json, and use

This proposal provides 2 security enhancements for the GCE Builder and simplifies the user experience as a result. The replacement of goauth2 with golang/oauth enables these changes:

1. **Compute Engine Service Accounts are supported**: If a user runs the GCE builder from a GCE Instance that has service accounts enabled with the correct scopes (and their Packer config file does not specify an account_file), they do not need a private key/account.json file - auth and token exchange are handled by the GCE instance's local metadata service. This eliminates the need for a customer to deploy a secret along with Packer - no creds required!

2. **client_secrets.json is no longer required**: This file was previously used only to extract the URIs for auth and token exchange. This functionality is baked into golang/oauth, and removing this as a required file means one less secret file a user has to create and manage. **Note:** the client_secrets key is no longer supported in the Packer config file and results in an error if present. Customers should be encouraged to update their config and delete that file as part of upgrading to this release.

The patch also updates black box tests to use a current Deb image and confirm to the new "no client_secrets.json" requirement.