From 706dd05e8da77a5f2ce54d3471f91b00e3aab48c Mon Sep 17 00:00:00 2001 From: Banti Gheneti Date: Wed, 17 Jun 2020 06:24:02 -0400 Subject: [PATCH] remote/gs: fix url signing when using GoogleStorage on GoogleComputeEngine (#4057) Fixes #4056 --- dvc/remote/gs.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/dvc/remote/gs.py b/dvc/remote/gs.py index 0138de627..e20a3260e 100644 --- a/dvc/remote/gs.py +++ b/dvc/remote/gs.py @@ -91,13 +91,30 @@ class GSRemoteTree(BaseRemoteTree): ) def _generate_download_url(self, path_info, expires=3600): + import google.auth + from google.auth import compute_engine + expiration = timedelta(seconds=int(expires)) bucket = self.gs.bucket(path_info.bucket) blob = bucket.get_blob(path_info.path) if blob is None: raise FileNotFoundError - return blob.generate_signed_url(expiration=expiration) + + if isinstance( + blob.client._credentials, google.auth.credentials.Signing + ): + # sign if we're able to sign with credentials. + return blob.generate_signed_url(expiration=expiration) + + auth_request = google.auth.transport.requests.Request() + # create signing credentials with the default credentials + # for use with Compute Engine and other environments where + # Client credentials cannot sign. + signing_credentials = compute_engine.IDTokenCredentials( + auth_request, "" + ) + return signing_credentials.signer.sign(blob) def exists(self, path_info): """Check if the blob exists. If it does not exist,