fix(auth): refine JSpecify nullability annotations for core ADC credentials

google-auth-library-java/credentials/java/com/google/auth/Credentials.java

@@ -121,7 +121,7 @@ public Map<String, List<String>> getRequestMetadata() throws IOException {
    * @param callback Callback to execute when the request is finished.
    */
   public void getRequestMetadata(
-      final URI uri, Executor executor, final RequestMetadataCallback callback) {
+      final @Nullable URI uri, Executor executor, final RequestMetadataCallback callback) {
     executor.execute(
         new Runnable() {
           @Override
@@ -137,7 +137,7 @@ public void run() {
    * @param uri URI of the entry point for the request.
    * @param callback Callback handler to execute when the metadata completes.
    */
-  protected final void blockingGetToCallback(URI uri, RequestMetadataCallback callback) {
+  protected final void blockingGetToCallback(@Nullable URI uri, RequestMetadataCallback callback) {
     Map<String, List<String>> result;
     try {
       result = getRequestMetadata(uri);

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java

@@ -40,6 +40,7 @@
 import java.io.InputStream;
 import java.util.Locale;
 import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Utility class for mTLS related operations.
@@ -64,8 +65,10 @@
    * @return The path to the certificate file.
    * @throws IOException if the certificate configuration cannot be found or loaded.
    */
   public static String getCertificatePath(
-      EnvironmentProvider envProvider, PropertyProvider propProvider, String certConfigPathOverride)
+      EnvironmentProvider envProvider,
+      PropertyProvider propProvider,
+      @Nullable String certConfigPathOverride)
       throws IOException {
     String certPath =
         getWorkloadCertificateConfiguration(envProvider, propProvider, certConfigPathOverride)
@@ -92,7 +95,9 @@
    * @throws IOException if the configuration file cannot be found, read, or parsed
    */
   static WorkloadCertificateConfiguration getWorkloadCertificateConfiguration(
-      EnvironmentProvider envProvider, PropertyProvider propProvider, String certConfigPathOverride)
+      EnvironmentProvider envProvider,
+      PropertyProvider propProvider,
+      @Nullable String certConfigPathOverride)
       throws IOException {
     File certConfig;
     if (certConfigPathOverride != null) {

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java

@@ -54,7 +54,7 @@
 public class X509Provider implements MtlsProvider {
   private final EnvironmentProvider envProvider;
   private final PropertyProvider propProvider;
-  private final String certConfigPathOverride;
+  private final @Nullable String certConfigPathOverride;
 
   /**
    * Creates an X509 provider with an override path for the certificate configuration, bypassing the
@@ -69,7 +69,7 @@ public class X509Provider implements MtlsProvider {
   public X509Provider(
       EnvironmentProvider envProvider,
       PropertyProvider propProvider,
-      String certConfigPathOverride) {
+      @Nullable String certConfigPathOverride) {
     this.envProvider = envProvider;
     this.propProvider = propProvider;
     this.certConfigPathOverride = certConfigPathOverride;

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java

@@ -287,9 +287,9 @@ static class Builder {
     private final String url;
     private final String region;
 
-    @Nullable private String requestPayload;
-    @Nullable private Map<String, String> additionalHeaders;
-    @Nullable private AwsDates dates;
+    private @Nullable String requestPayload;
+    private @Nullable Map<String, String> additionalHeaders;
+    private @Nullable AwsDates dates;
 
     private Builder(
         AwsSecurityCredentials awsSecurityCredentials,
@@ -303,7 +303,7 @@ private Builder(
     }
 
     @CanIgnoreReturnValue
-    Builder setRequestPayload(String requestPayload) {
+    Builder setRequestPayload(@Nullable String requestPayload) {
       this.requestPayload = requestPayload;
       return this;
     }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsSecurityCredentials.java

@@ -44,7 +44,7 @@ public class AwsSecurityCredentials {
   private final String accessKeyId;
   private final String secretAccessKey;
 
-  @Nullable private final String sessionToken;
+  private final @Nullable String sessionToken;
 
   /**
    * Constructor for AWSSecurityCredentials.
@@ -83,8 +83,7 @@ public String getSecretAccessKey() {
    *
    * @return the AWS session token.
    */
-  @Nullable
-  public String getSessionToken() {
+  public @Nullable String getSessionToken() {
     return sessionToken;
   }
 }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

@@ -154,7 +154,7 @@ public enum GoogleAuthTransport {
 
     private final String label;
 
-    private GoogleAuthTransport(String label) {
+    GoogleAuthTransport(String label) {
       this.label = label;
     }
 
@@ -185,7 +185,7 @@ public enum BindingEnforcement {
 
     private final String label;
 
-    private BindingEnforcement(String label) {
+    BindingEnforcement(String label) {
       this.label = label;
     }
 
@@ -455,7 +455,7 @@ public AccessToken refreshAccessToken() throws IOException {
         OAuth2Utils.validateString(responseData, "access_token", PARSE_ERROR_PREFIX);
     int expiresInSeconds =
         OAuth2Utils.validateInt32(responseData, "expires_in", PARSE_ERROR_PREFIX);
-    long expiresAtMilliseconds = clock.currentTimeMillis() + expiresInSeconds * 1000;
+    long expiresAtMilliseconds = clock.currentTimeMillis() + expiresInSeconds * 1000L;
 
     return new AccessToken(accessToken, new Date(expiresAtMilliseconds));
   }
@@ -828,7 +828,7 @@ public byte[] sign(byte[] toSign) {
           this.getUniverseDomain(),
           transportFactory.create(),
           toSign,
-          Collections.<String, Object>emptyMap());
+          Collections.emptyMap());
     } catch (SigningException ex) {
       throw ex;
     } catch (RuntimeException ex) {

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CredentialAccessBoundary.java

@@ -166,7 +166,7 @@ public static final class AccessBoundaryRule {
     private final String availableResource;
     private final List<String> availablePermissions;
 
-    @Nullable private final AvailabilityCondition availabilityCondition;
+    private final @Nullable AvailabilityCondition availabilityCondition;
 
     AccessBoundaryRule(
         String availableResource,
@@ -197,8 +197,7 @@ public List<String> getAvailablePermissions() {
       return availablePermissions;
     }
 
-    @Nullable
-    public AvailabilityCondition getAvailabilityCondition() {
+    public @Nullable AvailabilityCondition getAvailabilityCondition() {
       return availabilityCondition;
     }
 
@@ -210,7 +209,7 @@ public static class Builder {
       private String availableResource;
       private List<String> availablePermissions;
 
-      @Nullable private AvailabilityCondition availabilityCondition;
+      private @Nullable AvailabilityCondition availabilityCondition;
 
       private Builder() {}
 
@@ -269,7 +268,8 @@ public Builder addAvailablePermission(String availablePermission) {
        * @return this {@code Builder} object
        */
       @CanIgnoreReturnValue
-      public Builder setAvailabilityCondition(AvailabilityCondition availabilityCondition) {
+      public Builder setAvailabilityCondition(
+          @Nullable AvailabilityCondition availabilityCondition) {
         this.availabilityCondition = availabilityCondition;
         return this;
       }
@@ -296,8 +296,8 @@ public AccessBoundaryRule build() {
     public static final class AvailabilityCondition {
       private final String expression;
 
-      @Nullable private final String title;
-      @Nullable private final String description;
+      private final @Nullable String title;
+      private final @Nullable String description;
 
       AvailabilityCondition(
           String expression, @Nullable String title, @Nullable String description) {
@@ -312,13 +312,11 @@ public String getExpression() {
         return expression;
       }
 
-      @Nullable
-      public String getTitle() {
+      public @Nullable String getTitle() {
         return title;
       }
 
-      @Nullable
-      public String getDescription() {
+      public @Nullable String getDescription() {
         return description;
       }
 
@@ -329,8 +327,8 @@ public static Builder newBuilder() {
       public static final class Builder {
         private String expression;
 
-        @Nullable private String title;
-        @Nullable private String description;
+        private @Nullable String title;
+        private @Nullable String description;
 
         private Builder() {}
 
@@ -358,7 +356,7 @@ public Builder setExpression(String expression) {
          * @return this {@code Builder} object
          */
         @CanIgnoreReturnValue
-        public Builder setTitle(String title) {
+        public Builder setTitle(@Nullable String title) {
           this.title = title;
           return this;
         }
@@ -370,7 +368,7 @@ public Builder setTitle(String title) {
          * @return this {@code Builder} object
          */
         @CanIgnoreReturnValue
-        public Builder setDescription(String description) {
+        public Builder setDescription(@Nullable String description) {
           this.description = description;
           return this;
         }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/DefaultCredentialsProvider.java

@@ -56,7 +56,9 @@
  */
 @NullMarked
 class DefaultCredentialsProvider {
+  static final Logger LOGGER = Logger.getLogger(DefaultCredentialsProvider.class.getName());
   static final DefaultCredentialsProvider DEFAULT = new DefaultCredentialsProvider();
+
   static final String CREDENTIAL_ENV_VAR = "GOOGLE_APPLICATION_CREDENTIALS";
   static final String QUOTA_PROJECT_ENV_VAR = "GOOGLE_CLOUD_QUOTA_PROJECT";
 
@@ -66,14 +68,11 @@ class DefaultCredentialsProvider {
   static final String CLOUD_SHELL_ENV_VAR = "DEVSHELL_CLIENT_PORT";
   static final String SKIP_APP_ENGINE_ENV_VAR = "GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE";
   static final String SPECIFICATION_VERSION = System.getProperty("java.specification.version");
-  static final String GAE_RUNTIME_VERSION =
+  static final @Nullable String GAE_RUNTIME_VERSION =
       System.getProperty("com.google.appengine.runtime.version");
-  static final String RUNTIME_JETTY_LOGGER = System.getProperty("org.eclipse.jetty.util.log.class");
-  static final Logger LOGGER = Logger.getLogger(DefaultCredentialsProvider.class.getName());
+  static final @Nullable String RUNTIME_JETTY_LOGGER = System.getProperty("org.eclipse.jetty.util.log.class");
   static final String NO_GCE_CHECK_ENV_VAR = "NO_GCE_CHECK";
   static final String GCE_METADATA_HOST_ENV_VAR = "GCE_METADATA_HOST";
-  static final String CLOUDSDK_CLIENT_ID =
-      "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com";
   static final String CLOUDSDK_CREDENTIALS_WARNING =
       "You are authenticating using user credentials. "
           + "For production, we recommend using service account credentials.\n\n"
@@ -136,7 +135,7 @@ final GoogleCredentials getDefaultCredentials(HttpTransportFactory transportFact
     // First try the environment variable
     GoogleCredentials credentials = null;
     String credentialsPath = getEnv(CREDENTIAL_ENV_VAR);
-    if (credentialsPath != null && credentialsPath.length() > 0) {
+    if (credentialsPath != null && !credentialsPath.isEmpty()) {
       LOGGER.log(
           Level.FINE,
           String.format("Attempting to load credentials from file: %s", credentialsPath));
@@ -234,7 +233,7 @@ final GoogleCredentials getDefaultCredentials(HttpTransportFactory transportFact
     if (credentials != null) {
       String quotaFromEnv = getEnv(QUOTA_PROJECT_ENV_VAR);
 
-      if (quotaFromEnv != null && quotaFromEnv.trim().length() > 0) {
+      if (quotaFromEnv != null && !quotaFromEnv.trim().isEmpty()) {
         credentials = credentials.createWithQuotaProject(quotaFromEnv);
       }
     }
@@ -357,8 +356,8 @@ Class<?> forName(String className) throws ClassNotFoundException {
     return System.getenv(name);
   }
 
-  @Nullable String getProperty(String property, @Nullable String def) {
-    return System.getProperty(property, def);
+  String getProperty(String property, String defaultValue) {
+    return System.getProperty(property, defaultValue);
   }
 
   boolean isFile(File file) {

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExecutableResponse.java

@@ -50,11 +50,11 @@ class ExecutableResponse {
   private final int version;
   private final boolean success;
 
-  @Nullable private Long expirationTime;
-  @Nullable private String tokenType;
-  @Nullable private String subjectToken;
-  @Nullable private String errorCode;
-  @Nullable private String errorMessage;
+  private @Nullable Long expirationTime;
+  private @Nullable String tokenType;
+  private @Nullable String subjectToken;
+  private @Nullable String errorCode;
+  private @Nullable String errorMessage;
 
   ExecutableResponse(GenericJson json) throws IOException {
     if (!json.containsKey("version")) {

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

@@ -144,7 +144,7 @@
    * external source for authentication to Google Cloud Platform, you must validate it before
    * providing it to any Google API or library. Providing an unvalidated credential configuration to
    * Google APIs can compromise the security of your systems and data. For more information, refer
    * to {@see <a
    * href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
    *
    * @param credentialsStream the stream with the credential definition.
@@ -163,7 +163,7 @@
    * external source for authentication to Google Cloud Platform, you must validate it before
    * providing it to any Google API or library. Providing an unvalidated credential configuration to
    * Google APIs can compromise the security of your systems and data. For more information, refer
    * to {@see <a
    * href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
    *
    * @param credentialsStream the stream with the credential definition.
@@ -675,8 +675,8 @@
     }
   }
 
-  private static String validateField(String field, String fieldName) throws IOException {
-    if (field == null || field.isEmpty()) {
+  private static String validateField(@Nullable String field, String fieldName) throws IOException {
+    if (Strings.isNullOrEmpty(field)) {
       throw new IOException(
           String.format(
               "Error reading GDCH service account credential from JSON, %s is misconfigured.",
@@ -712,8 +712,8 @@
       return transport;
     }
 
-    private void setTransport(String caCertPath) throws IOException {
-      if (caCertPath == null || caCertPath.isEmpty()) {
+    private void setTransport(@Nullable String caCertPath) throws IOException {
+      if (Strings.isNullOrEmpty(caCertPath)) {
         this.transport = new NetHttpTransport();
         return;
       }
@@ -752,7 +752,6 @@
    * @param payload The JWS payload containing claims like "iss", "sub", and "aud".
    * @return A complete, signed JWS string in the format {@code [header].[payload].[signature]}.
    * @throws GeneralSecurityException If signing fails due to cryptographic errors.
-   * @throws IOException If serialization or transcoding fails.
    */
   @VisibleForTesting
   static String signUsingEsSha256(
@@ -778,7 +777,7 @@
           SecurityUtils.sign(SecurityUtils.getEs256SignatureAlgorithm(), privateKey, contentBytes);
 
       // 3. Transcode the signature from DER to Concatenated R|S.
-      byte[] jwsSignature = transcodeDerToConcat(signature, 64);
+      byte[] jwsSignature = transcodeDerToConcat(signature);
 
       // 4. Return final JWS: [Signing Input] + '.' + Base64URL(Signature)
       return content + "." + Base64.getUrlEncoder().withoutPadding().encodeToString(jwsSignature);
@@ -795,13 +794,11 @@
    * <p>Concatenated format: {@code r | s} (where {@code |} is concatenation).
    *
    * @param derSignature The raw bytes of the DER-encoded signature.
-   * @param outputLength The total expected length of the concatenated signature (64 bytes for
-   *     ES256).
    * @return The signature in concatenated R|S format.
    * @throws IOException If the DER format is invalid.
    */
   @VisibleForTesting
-  static byte[] transcodeDerToConcat(byte[] derSignature, int outputLength)
+  static byte[] transcodeDerToConcat(byte[] derSignature)
       throws GoogleAuthException {
     // Validate basic ASN.1 DER structure (0x30 = SEQUENCE)
     if (derSignature.length < 8 || derSignature[0] != 0x30) {
@@ -847,7 +844,7 @@
     System.arraycopy(derSignature, offset, s, 0, sLength);
 
     // Concatenate r and s into fixed-length segments (32 bytes each for ES256)
-    int keySizeBytes = outputLength / 2;
+    int keySizeBytes = 64 / 2;
     if (r.length > keySizeBytes || s.length > keySizeBytes) {
       throw new GoogleAuthException(
           false,
@@ -858,9 +855,9 @@
           null);
     }
 
-    byte[] result = new byte[outputLength];
+    byte[] result = new byte[64];
     System.arraycopy(r, 0, result, keySizeBytes - r.length, r.length);
-    System.arraycopy(s, 0, result, outputLength - s.length, s.length);
+    System.arraycopy(s, 0, result, 64 - s.length, s.length);
 
     return result;
   }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleAuthException.java

@@ -57,7 +57,7 @@ class GoogleAuthException extends IOException implements Retryable {
    * @param cause The cause (which is saved for later retrieval by the {@link #getCause()} method).
    *     (A null value is permitted, and indicates that the cause is nonexistent or unknown.)
    */
-  GoogleAuthException(boolean isRetryable, int retryCount, String message, Throwable cause) {
+  GoogleAuthException(boolean isRetryable, int retryCount, String message, @Nullable Throwable cause) {
     super(message, cause);
     this.isRetryable = isRetryable;
     this.retryCount = retryCount;