Upgrade googleauth to 1.x release

[rbclark]

Describe the Enhancement:

The googleauth gem is currently on a pre 1.0 release which is no longer being updated. For future features the 1.x release will need to be used.

Describe the Need:

Currently when performing a scan with GCP, the recommended method of acquiring credentials is via Workload Identity Federation. Currently the googleauth gem does not support that feature, however I am working to add the feature and already have a mostly working prototype. In order for inspec to support using this feature as well, this gem will need to be updated to the 1.x release of googleauth, since new features in that gem will not be backported to the old version that is being used here.

Current Alternative

I'm currently backporting my work to a 0.14.x branch for my own purposes but that will never be an official solution.

Can We Help You Implement This?:

Based on my investigation, it looks like the google-api gems are all backwards compatible with pre 1.0 versions of the googleauth gem, however it looks like the older gems which are currently in use do not support the 1.x releases. In order for this request to be possible it seems likely that the other gems will need to be updated as well.

[wyardley]

Yes please! Running into this issue, and because of how inspec plugins work, took me a little to figure out that this is where it needs to get updated.

[brettcurtis]

Took me a while to hunt this down, any traction on this?

[dazuma]

The core issue is #658. Fix that, and the pinning of googleauth to pre-1.0 should go away.

[nitin-koshti11]

Adding a security-driven angle to nudge this along.

The googleauth (>= 0.16.2, < 1.9.0) pin in train.gemspec (introduced in #773 to work around a Windows / google-cloud-env registry crash in googleauth 1.11.0) is now transitively blocking the ruby-jwt 3.2.0 security fix — high-severity empty-key HMAC bypass advisory.

The chain (resolver output from a real Bundler run):

train >= 3.12.3
  → googleauth >= 0.16.2, < 1.9.0          (train.gemspec cap)
  → googleauth < 1.15.0 ⇒ jwt >= 1.4, < 3.0
  ⇒ jwt 3.x is unreachable for any downstream consumer of train

Anything pulling in train (chef, inspec, kitchen-inspec, chefspec, berkshelf, …) is therefore stuck below the patched jwt. Concretely, Dependabot fired this on our compute_amis repo and we couldn't close it without forking — bundle update keeps the resolver at jwt 2.10.3.

Two things that might unblock #729 now:

1. The compute_smbios Windows registry crash that motivated gem: pin down googleauth gem to below 1.9 #773 has been fixed upstream — see googleapis/google-cloud-env v2.2.x. Current googleauth (1.16.2) pulls in a google-cloud-env >= 2.2.x that no longer touches Win32::Registry blindly. Worth re-running the original Windows CI repro against googleauth 1.16.2.
2. Once the Windows path is verified, googleauth 1.15.0+ already widened its jwt requirement to >= 1.4, < 4.0, so bumping the train cap to < 2.a (or just < 1.17 to be conservative) would let jwt 3.x flow through downstream graphs.

Happy to send a draft PR that bumps the cap and adds a Windows CI matrix run against googleauth 1.16.2 to verify the registry crash is gone, if a maintainer can confirm that's an acceptable direction. cc @ahasunos (PR #773 author) — does the Windows CI you fixed in #773 still have a fresh repro target?