func NewDriverGCE(ui packer.Ui, projectId string, c *clientSecrets, key []byte) (Driver, error) {
	log.Printf("[INFO] Requesting token...")
	log.Printf("[INFO]   -- Email: %s", c.Web.ClientEmail)
	log.Printf("[INFO]   -- Scopes: %s", DriverScopes)
	log.Printf("[INFO]   -- Private Key Length: %d", len(key))
	log.Printf("[INFO]   -- Token URL: %s", c.Web.TokenURI)
	jwtTok := jwt.NewToken(c.Web.ClientEmail, DriverScopes, key)
	jwtTok.ClaimSet.Aud = c.Web.TokenURI
	token, err := jwtTok.Assert(new(http.Client))
	if err != nil {
		return nil, err
	}

	transport := &oauth.Transport{
		Config: &oauth.Config{
			ClientId: c.Web.ClientId,
			Scope:    DriverScopes,
			TokenURL: c.Web.TokenURI,
			AuthURL:  c.Web.AuthURI,
		},
		Token: token,
	}

	log.Printf("[INFO] Instantiating client...")
	service, err := compute.New(transport.Client())
	if err != nil {
		return nil, err
	}

	return &driverGCE{
		projectId: projectId,
		service:   service,
		ui:        ui,
	}, nil
}

func (uploader *Uploader) initGoogleService() error {
	token := jwt.NewToken(
		uploader.config.ClientEmail,
		strings.Join(GOOGLE_SERVICE_SCOPE, " "),
		[]byte(uploader.config.PrivateKey),
	)

	client := &http.Client{}

	oauthToken, err := token.Assert(client)
	if err != nil {
		return err
	}

	transport := &oauth.Transport{
		Token: oauthToken,
	}

	c := transport.Client()

	_, err = oauth2.New(c)
	if err != nil {
		return err
	}

	driveService, err := drive.New(c)
	if err != nil {
		return err
	}

	uploader.driveService = driveService

	return nil
}

func (s *Gcs) getOauthClient() *http.Client {
	// Read the secret file bytes into the config.
	secret_bytes, err := ioutil.ReadFile(s.SecretFile)
	if err != nil {
		log.Fatal("error reading secrets file: ", err)
		return nil
	}

	var config struct {
		Web struct {
			ClientEmail string `json:"client_email"`
			ClientID    string `json:"client_id"`
			TokenURI    string `json:"token_uri"`
		}
	}
	err = json.Unmarshal(secret_bytes, &config)
	if err != nil {
		log.Println(s.SecretFile)
		log.Fatal("error unmarshalling secrets: ", err)
		return nil
	}

	// Get the project ID from the client ID.
	project_id := strings.SplitN(config.Web.ClientID, "-", 2)[0]
	log.Println("project_id: ", project_id)

	// Read the pem file bytes for the private key.
	key_bytes, err := ioutil.ReadFile(s.PemFile)
	if err != nil {
		log.Fatal("error reading private key file: ", err)
		return nil
	}

	// Craft the ClaimSet and JWT token.
	scope := gcs.DevstorageFull_controlScope
	token := jwt.NewToken(config.Web.ClientEmail, scope, key_bytes)
	token.ClaimSet.Aud = config.Web.TokenURI

	// We need to provide a client.
	client := &http.Client{}

	// Get the access token.
	oauth_token, err := token.Assert(client)
	if err != nil {
		log.Fatal("assertion error: ", err)
		return nil
	}

	// Refresh token will be missing, but this access_token will be good
	// for one hour.
	log.Printf("access_token = %v\n", oauth_token.AccessToken)
	log.Printf("refresh_token = %v\n", oauth_token.RefreshToken)
	log.Printf("expires %v\n", oauth_token.Expiry)

	transport := &oauth.Transport{Token: oauth_token}

	return transport.Client()
}

func NewShortener(issuer string, key []byte) (s *Shortener, err error) {
	s = &Shortener{}
	token := jwt.NewToken(issuer, urlshortener.UrlshortenerScope, key)
	if s.transport, err = jwt.NewTransport(token); err != nil {
		return
	}
	s.svc, err = urlshortener.New(s.transport.Client())
	return
}

func GetServiceAccountToken(config *ServiceAccountConfig) (*oauth.Token, error) {
	token := jwt.NewToken(config.ClientEmail, strings.Join(config.Scope, " "), []byte(config.PrivateKey))

	client := &http.Client{}
	oauthToken, err := token.Assert(client)
	if err != nil {
		return nil, err
	}

	return oauthToken, nil
}

func (c *Config) loadAndValidate() error {
	var account accountFile
	var secrets clientSecretsFile

	if err := loadJSON(&account, c.AccountFile); err != nil {
		return fmt.Errorf(
			"Error loading account file '%s': %s",
			c.AccountFile,
			err)
	}

	if err := loadJSON(&secrets, c.ClientSecretsFile); err != nil {
		return fmt.Errorf(
			"Error loading client secrets file '%s': %s",
			c.ClientSecretsFile,
			err)
	}

	// Get the token for use in our requests
	log.Printf("[INFO] Requesting Google token...")
	log.Printf("[INFO]   -- Email: %s", account.ClientEmail)
	log.Printf("[INFO]   -- Scopes: %s", clientScopes)
	log.Printf("[INFO]   -- Private Key Length: %d", len(account.PrivateKey))
	log.Printf("[INFO]   -- Token URL: %s", secrets.Web.TokenURI)
	jwtTok := jwt.NewToken(
		account.ClientEmail,
		clientScopes,
		[]byte(account.PrivateKey))
	jwtTok.ClaimSet.Aud = secrets.Web.TokenURI
	token, err := jwtTok.Assert(new(http.Client))
	if err != nil {
		return fmt.Errorf("Error retrieving auth token: %s", err)
	}

	// Instantiate the transport to communicate to Google
	transport := &oauth.Transport{
		Config: &oauth.Config{
			ClientId: account.ClientId,
			Scope:    clientScopes,
			TokenURL: secrets.Web.TokenURI,
			AuthURL:  secrets.Web.AuthURI,
		},
		Token: token,
	}

	log.Printf("[INFO] Instantiating GCE client...")
	c.clientCompute, err = compute.New(transport.Client())
	if err != nil {
		return err
	}

	return nil
}

func prepareServiceClient(data *oauthConfig, keyBytes []byte) (
	*http.Client, error) {
	// Craft the ClaimSet and JWT token.
	token := jwt.NewToken(data.Web.Client_Email, oauthScope, keyBytes)
	token.ClaimSet.Aud = data.Web.Token_Uri

	transport, err := jwt.NewTransport(token)
	if err != nil {
		log.Fatal("Assertion error:", err)
	}

	return transport.Client(), nil
}

func (c *Client) connect() (*bigquery.Service, error) {
	if c.token != nil {
		fmt.Println("token expired", c.token.Expired())
		fmt.Println("token expiry", c.token.Expiry)

		if !c.token.Expired() && c.service != nil {
			fmt.Println("REUSE SERVICE")
			return c.service, nil
		}
	}

	// generate auth token and create service object
	authScope := bigquery.BigqueryScope
	pemKeyBytes, err := ioutil.ReadFile(c.pemPath)
	if err != nil {
		panic(err)
	}

	t := jwt.NewToken(c.accountEmailAddress, bigquery.BigqueryScope, pemKeyBytes)

	httpClient := &http.Client{}
	token, err := t.Assert(httpClient)
	if err != nil {
		return nil, err
	}

	c.token = token

	config := &oauth.Config{
		ClientId:     c.userAccountClientId,
		ClientSecret: c.clientSecret,
		Scope:        authScope,
		AuthURL:      "https://accounts.google.com/o/oauth2/auth",
		TokenURL:     "https://accounts.google.com/o/oauth2/token",
	}

	transport := &oauth.Transport{
		Token:  token,
		Config: config,
	}

	client := transport.Client()

	service, err := bigquery.New(client)
	if err != nil {
		return nil, err
	}

	c.service = service
	return service, nil
}

func NewGCSStorage(gcsClientEmail, gcsTokenURI string, gcsPemBytes []byte) (Storage, error) {
	t := jwt.NewToken(gcsClientEmail, storage.DevstorageFull_controlScope, gcsPemBytes)
	t.ClaimSet.Aud = gcsTokenURI
	transport, err := jwt.NewTransport(t)
	if err != nil {
		return nil, err
	}
	client := transport.Client()
	gcsService, err := storage.New(client)
	if err != nil {
		return nil, err
	}
	return &GoogleCloudStorage{gcsService}, nil
}

// Helper method to create an authenticated connection.
func connect() (*oauth.Token, *bigquery.Service, error) {
	if *clientId == "" {
		return nil, nil, fmt.Errorf("no client id specified")
	}
	if *serviceAccount == "" {
		return nil, nil, fmt.Errorf("no service account specified")
	}
	if *projectId == "" {
		return nil, nil, fmt.Errorf("no project id specified")
	}
	authScope := bigquery.BigqueryScope
	if *pemFile == "" {
		return nil, nil, fmt.Errorf("no credentials specified")
	}
	pemBytes, err := ioutil.ReadFile(*pemFile)
	if err != nil {
		return nil, nil, fmt.Errorf("could not access credential file %v - %v", pemFile, err)
	}

	t := jwt.NewToken(*serviceAccount, authScope, pemBytes)
	token, err := t.Assert(&http.Client{})
	if err != nil {
		fmt.Printf("Invalid token: %v\n", err)
		return nil, nil, err
	}
	config := &oauth.Config{
		ClientId:     *clientId,
		ClientSecret: *clientSecret,
		Scope:        authScope,
		AuthURL:      "https://accounts.google.com/o/oauth2/auth",
		TokenURL:     "https://accounts.google.com/o/oauth2/token",
	}

	transport := &oauth.Transport{
		Token:  token,
		Config: config,
	}
	client := transport.Client()

	service, err := bigquery.New(client)
	if err != nil {
		fmt.Printf("Failed to create new service: %v\n", err)
		return nil, nil, err
	}

	return token, service, nil
}

// GetClient returns an OAuth2 authenticated http.Client that uses the identity
// of the server.
//
// A private key is required to assert the identity.
func (s *ServiceAccount) GetClient(scope string, r http.RoundTripper) (*http.Client, error) {
	if r == nil {
		r = http.DefaultTransport
	}
	tok := jwt.NewToken(s.EmailAddress, scope, []byte(s.PrivateKey))

	// Get the access token right away by doing an HTTP request.
	accessToken, err := tok.Assert(&http.Client{Transport: r})
	if err != nil {
		return nil, fmt.Errorf("failed to assert new oauth2 token: %s", err)
	}
	t := &transport{
		token:       tok,
		accessToken: accessToken,
		projectID:   s.ProjectID,
		transport:   r,
	}
	return &http.Client{Transport: t}, nil
}

func (s *gcsStorage) init() error {
	jwtToken := jwt.NewToken(os.Getenv(gcsIssEnvVar), gcs.DevstorageRead_writeScope, []byte(os.Getenv(gcsKeyEnvVar)))
	oauthToken, err := jwtToken.Assert(http.DefaultClient)
	if err != nil {
		return err
	}

	client := (&jwt.Transport{jwtToken, oauthToken, http.DefaultTransport}).Client()

	service, err := gcs.New(client)
	if err != nil {
		return err
	}

	s.client = client
	s.service = service
	s.bucket = os.Getenv(gcsBucketEnvVar)

	return nil
}

func (c ApiClient) GetToken() *oauth.Token {

	keyBytes, err := base64.StdEncoding.DecodeString(c.EncodedKey)
	if err != nil {
		log.Fatal("Error decoding private key:", err)
	}

	t := jwt.NewToken(c.ClientId, scope, keyBytes)
	t.ClaimSet.Aud = tokenURL

	log.Print("Requesting new access token.\n")
	httpClient := &http.Client{}
	token, err := t.Assert(httpClient)
	if err != nil {
		log.Fatal("assertion error:", err)
	}

	log.Printf("New access token acquired.\n")
	return token
}

func NewDriverGCE(ui packer.Ui, p string, a *accountFile, c *clientSecretsFile) (Driver, error) {
	// Get the token for use in our requests
	log.Printf("[INFO] Requesting Google token...")
	log.Printf("[INFO]   -- Email: %s", a.ClientEmail)
	log.Printf("[INFO]   -- Scopes: %s", DriverScopes)
	log.Printf("[INFO]   -- Private Key Length: %d", len(a.PrivateKey))
	log.Printf("[INFO]   -- Token URL: %s", c.Web.TokenURI)
	jwtTok := jwt.NewToken(
		a.ClientEmail,
		DriverScopes,
		[]byte(a.PrivateKey))
	jwtTok.ClaimSet.Aud = c.Web.TokenURI
	token, err := jwtTok.Assert(new(http.Client))
	if err != nil {
		return nil, fmt.Errorf("Error retrieving auth token: %s", err)
	}

	// Instantiate the transport to communicate to Google
	transport := &oauth.Transport{
		Config: &oauth.Config{
			ClientId: a.ClientId,
			Scope:    DriverScopes,
			TokenURL: c.Web.TokenURI,
			AuthURL:  c.Web.AuthURI,
		},
		Token: token,
	}

	log.Printf("[INFO] Instantiating GCE client...")
	service, err := compute.New(transport.Client())
	if err != nil {
		return nil, err
	}

	return &driverGCE{
		projectId: p,
		service:   service,
		ui:        ui,
	}, nil
}

func main() {

	token := jwt.NewToken(Email, Scope, []byte(PEM))
	transport, err := jwt.NewTransport(token)
	if err != nil {
		log.Fatal(err)
	}

	client := transport.Client()
	bq, err := bigquery.New(client)
	if err != nil {
		log.Fatal(err)
	}

	rows := make([]*bigquery.TableDataInsertAllRequestRows, 0)

	row := &bigquery.TableDataInsertAllRequestRows{
		Json: make(map[string]bigquery.JsonValue, 0),
	}
	row.Json["url"] = "https://github.com"
	row.Json["source"] = "example"
	row.Json["t"] = time.Now().Unix()
	row.Json["http_status"] = 200

	rows = append(rows, row)

	req := &bigquery.TableDataInsertAllRequest{
		Rows: rows,
	}

	call := bq.Tabledata.InsertAll(App, Dataset, Table, req)
	resp, err := call.Do()
	if err != nil {
		log.Fatal(err)
	}

	buf, _ := json.Marshal(resp)
	log.Print(string(buf))
}

func main() {
	goptions.ParseAndFail(&options)
	defer options.KeyFile.Close()
	pemBytes, err := ioutil.ReadAll(options.KeyFile)
	if err != nil {
		log.Fatalf("Could not read keyfile: %s", err)
	}

	token := jwt.NewToken(options.ClientId, storage.DevstorageRead_writeScope, pemBytes)
	// token.ClaimSet.Aud = aud
	c := &http.Client{}
	oauthToken, err := token.Assert(c)
	if err != nil {
		log.Fatalf("Could not get OAuth token: %s", err)
	}

	c.Transport = &oauth.Transport{
		Token: oauthToken,
	}
	service, err := storage.New(c)
	if err != nil {
		log.Fatalf("Could not use storage API: %s", err)
	}
	objs, err := service.Objects.List(options.Bucket).Do()
	if err != nil {
		log.Fatalf("Could not list content of bucket %s: %s", options.Bucket, err)
	}
	for _, obj := range objs.Items {
		log.Printf("%s/%s: %s\n", options.Bucket, obj.Name, obj.SelfLink)
	}

	data := strings.NewReader("Some Data")
	newObj, err := service.Objects.Insert(options.Bucket, &storage.Object{}).Name("gcs-test").Media(data).Do()
	if err != nil {
		log.Fatalf("Could not create new object: %s", err)
	}
	log.Printf("Uploaded to %s", newObj.SelfLink)
}

func (t *transport) Refresh() error {
	// Before we can get a new oauth token, we have to produce a jwt token
	//
	// the oAuth token returned does not contain a refresh token and expires after one hour,
	// which is the same expiration the JWT token provides. Therefore it does not make sense
	// to keep the JWT token around, just rebuild it on every refresh

	// Read the secret file bytes into the config.
	secretFileBytes, err := ioutil.ReadFile(t.ClientSecretFileName)
	if err != nil {
		return fmt.Errorf("Error reading file %q: %v", t.ClientSecretFileName, err)
	}

	var config keyConfig

	err = json.Unmarshal(secretFileBytes, &config)
	if err != nil {
		return fmt.Errorf("Failed to unmarshall json in %q: %v", t.ClientSecretFileName, err)
	}

	// Craft the ClaimSet and JWT token.
	jwtToken := jwt.NewToken(config.ClientEmail, strings.Join(t.Scopes, " "), []byte(config.PrivateKey))
	//jwtToken.ClaimSet.Aud = config.Web.TokenURI // just in case: assume that TokenURI from secret.json is more current than the default jwt package's

	// assert the jwtToken to get the oAuth Token
	client := urlfetch.Client(t.Context)
	t.Token, err = jwtToken.Assert(client)
	if err != nil {
		return fmt.Errorf("Assert jwt token error: %v", err)
	}

	if t.TokenCache != nil {
		// Cache the token and ignore error (as we can always get a new one).
		t.TokenCache.PutToken(t.Token)
	}
	return nil
}

func main() {
	flag.Parse()

	if *secretsFile == "" || *pemFile == "" {
		flag.Usage()
		fmt.Println(usageMsg)
		return
	}

	// Read the secret file bytes into the config.
	secretBytes, err := ioutil.ReadFile(*secretsFile)
	if err != nil {
		log.Fatal("error reading secerets file:", err)
	}
	var config struct {
		Web struct {
			ClientEmail string `json:"client_email"`
			ClientID    string `json:"client_id"`
			TokenURI    string `json:"token_uri"`
		}
	}
	err = json.Unmarshal(secretBytes, &config)
	if err != nil {
		log.Fatal("error unmarshalling secerets:", err)
	}

	// Get the project ID from the client ID.
	projectID := strings.SplitN(config.Web.ClientID, "-", 2)[0]

	// Read the pem file bytes for the private key.
	keyBytes, err := ioutil.ReadFile(*pemFile)
	if err != nil {
		log.Fatal("error reading private key file:", err)
	}

	// Craft the ClaimSet and JWT token.
	t := jwt.NewToken(config.Web.ClientEmail, scope, keyBytes)
	t.ClaimSet.Aud = config.Web.TokenURI

	// We need to provide a client.
	c := &http.Client{}

	// Get the access token.
	o, err := t.Assert(c)
	if err != nil {
		log.Fatal("assertion error:", err)
	}

	// Refresh token will be missing, but this access_token will be good
	// for one hour.
	fmt.Printf("access_token = %v\n", o.AccessToken)
	fmt.Printf("refresh_token = %v\n", o.RefreshToken)
	fmt.Printf("expires %v\n", o.Expiry)

	// Form the request to list Google Cloud Storage buckets.
	req, err := http.NewRequest("GET", "https://storage.googleapis.com/", nil)
	if err != nil {
		log.Fatal("http.NewRequest:", err)
	}
	req.Header.Set("Authorization", "OAuth "+o.AccessToken)
	req.Header.Set("x-goog-api-version", "2")
	req.Header.Set("x-goog-project-id", projectID)

	// Make the request.
	r, err := c.Do(req)
	if err != nil {
		log.Fatal("API request error:", err)
	}
	defer r.Body.Close()

	// Write the response to standard output.
	res, err := ioutil.ReadAll(r.Body)
	if err != nil {
		log.Fatal("error reading API request results:", err)
	}
	fmt.Printf("\nRESULT:\n%s\n", res)
}

func updatePopularPackagesOnce() error {
	const n = 25
	c := http.DefaultClient
	o, err := jwt.NewToken(
		secrets.ServiceAccountSecrets.Web.ClientEmail,
		"https://www.googleapis.com/auth/analytics.readonly",
		secrets.serviceAccountPEMBytes).Assert(c)
	if err != nil {
		return err
	}
	q := url.Values{
		"start-date":   {time.Now().Add(-8 * 24 * time.Hour).Format("2006-01-02")},
		"end-date":     {time.Now().Format("2006-01-02")},
		"ids":          {"ga:58440332"},
		"dimensions":   {"ga:pagePath"},
		"metrics":      {"ga:visitors"},
		"sort":         {"-ga:visitors"},
		"filters":      {`ga:previousPagePath!=/;ga:pagePath=~^/[a-z][^.?]*\.[^?]+$`},
		"max-results":  {strconv.Itoa(n + 10)},
		"access_token": {o.AccessToken},
	}
	resp, err := c.Get("https://www.googleapis.com/analytics/v3/data/ga?" + q.Encode())
	if err != nil {
		return err
	}
	defer resp.Body.Close()

	var data struct {
		Rows [][]string `json:"rows"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		return err
	}
	paths := make([]string, len(data.Rows))
	for i, r := range data.Rows {
		if !strings.HasPrefix(r[0], "/") {
			return errors.New("bad path value " + r[0])
		}
		paths[i] = r[0][1:]
	}
	pkgs, err := db.Packages(paths)
	if err != nil {
		return err
	}

	i := 0
	prev := "-"
	for _, pkg := range pkgs {
		if strings.HasPrefix(pkg.Path, prev) {
			continue
		}
		prev = pkg.Path + "/"
		pkgs[i] = pkg
		i += 1
		if i >= n {
			break
		}
	}
	pkgs = pkgs[:i]

	popularMutex.Lock()
	popularPackages = pkgs
	popularMutex.Unlock()

	return nil
}