We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Docs: compute_engine.credentials doesn't render note for service_account_email
On this doc item: https://google-auth.readthedocs.io/en/latest/reference/google.auth.compute_engine.credentials.html#google.auth.compute_engine.credentials.Credentials.service_account_email

The rendered docs say simply `The service account email.`

However, the [docstring](https://google-auth.readthedocs.io/en/latest/_modules/google/auth/compute_engine/credentials.html#Credentials.refresh) has more information:

```
        """The service account email.

        .. note: This is not guaranteed to be set until :meth`refresh` has been
            called.
        """
```

Why is this important note not rendered?

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `google/auth/compute_engine/credentials.py`
Content:
```
1 # Copyright 2016 Google Inc.
2 #
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
6 #
7 #      http://www.apache.org/licenses/LICENSE-2.0
8 #
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
14 
15 """Google Compute Engine credentials.
16 
17 This module provides authentication for application running on Google Compute
18 Engine using the Compute Engine metadata server.
19 
20 """
21 
22 import datetime
23 
24 import six
25 
26 from google.auth import _helpers
27 from google.auth import credentials
28 from google.auth import exceptions
29 from google.auth import iam
30 from google.auth import jwt
31 from google.auth.compute_engine import _metadata
32 from google.oauth2 import _client
33 
34 
35 class Credentials(credentials.ReadOnlyScoped, credentials.Credentials):
36     """Compute Engine Credentials.
37 
38     These credentials use the Google Compute Engine metadata server to obtain
39     OAuth 2.0 access tokens associated with the instance's service account.
40 
41     For more information about Compute Engine authentication, including how
42     to configure scopes, see the `Compute Engine authentication
43     documentation`_.
44 
45     .. note:: Compute Engine instances can be created with scopes and therefore
46         these credentials are considered to be 'scoped'. However, you can
47         not use :meth:`~google.auth.credentials.ScopedCredentials.with_scopes`
48         because it is not possible to change the scopes that the instance
49         has. Also note that
50         :meth:`~google.auth.credentials.ScopedCredentials.has_scopes` will not
51         work until the credentials have been refreshed.
52 
53     .. _Compute Engine authentication documentation:
54         https://cloud.google.com/compute/docs/authentication#using
55     """
56 
57     def __init__(self, service_account_email="default"):
58         """
59         Args:
60             service_account_email (str): The service account email to use, or
61                 'default'. A Compute Engine instance may have multiple service
62                 accounts.
63         """
64         super(Credentials, self).__init__()
65         self._service_account_email = service_account_email
66 
67     def _retrieve_info(self, request):
68         """Retrieve information about the service account.
69 
70         Updates the scopes and retrieves the full service account email.
71 
72         Args:
73             request (google.auth.transport.Request): The object used to make
74                 HTTP requests.
75         """
76         info = _metadata.get_service_account_info(
77             request, service_account=self._service_account_email
78         )
79 
80         self._service_account_email = info["email"]
81         self._scopes = info["scopes"]
82 
83     def refresh(self, request):
84         """Refresh the access token and scopes.
85 
86         Args:
87             request (google.auth.transport.Request): The object used to make
88                 HTTP requests.
89 
90         Raises:
91             google.auth.exceptions.RefreshError: If the Compute Engine metadata
92                 service can't be reached if if the instance has not
93                 credentials.
94         """
95         try:
96             self._retrieve_info(request)
97             self.token, self.expiry = _metadata.get_service_account_token(
98                 request, service_account=self._service_account_email
99             )
100         except exceptions.TransportError as caught_exc:
101             new_exc = exceptions.RefreshError(caught_exc)
102             six.raise_from(new_exc, caught_exc)
103 
104     @property
105     def service_account_email(self):
106         """The service account email.
107 
108         .. note: This is not guaranteed to be set until :meth`refresh` has been
109             called.
110         """
111         return self._service_account_email
112 
113     @property
114     def requires_scopes(self):
115         """False: Compute Engine credentials can not be scoped."""
116         return False
117 
118 
119 _DEFAULT_TOKEN_LIFETIME_SECS = 3600  # 1 hour in seconds
120 _DEFAULT_TOKEN_URI = "https://www.googleapis.com/oauth2/v4/token"
121 
122 
123 class IDTokenCredentials(credentials.Credentials, credentials.Signing):
124     """Open ID Connect ID Token-based service account credentials.
125 
126     These credentials relies on the default service account of a GCE instance.
127 
128     In order for this to work, the GCE instance must have been started with
129     a service account that has access to the IAM Cloud API.
130     """
131 
132     def __init__(
133         self,
134         request,
135         target_audience,
136         token_uri=_DEFAULT_TOKEN_URI,
137         additional_claims=None,
138         service_account_email=None,
139     ):
140         """
141         Args:
142             request (google.auth.transport.Request): The object used to make
143                 HTTP requests.
144             target_audience (str): The intended audience for these credentials,
145                 used when requesting the ID Token. The ID Token's ``aud`` claim
146                 will be set to this string.
147             token_uri (str): The OAuth 2.0 Token URI.
148             additional_claims (Mapping[str, str]): Any additional claims for
149                 the JWT assertion used in the authorization grant.
150             service_account_email (str): Optional explicit service account to
151                 use to sign JWT tokens.
152                 By default, this is the default GCE service account.
153         """
154         super(IDTokenCredentials, self).__init__()
155 
156         if service_account_email is None:
157             sa_info = _metadata.get_service_account_info(request)
158             service_account_email = sa_info["email"]
159         self._service_account_email = service_account_email
160 
161         self._signer = iam.Signer(
162             request=request,
163             credentials=Credentials(),
164             service_account_email=service_account_email,
165         )
166 
167         self._token_uri = token_uri
168         self._target_audience = target_audience
169 
170         if additional_claims is not None:
171             self._additional_claims = additional_claims
172         else:
173             self._additional_claims = {}
174 
175     def with_target_audience(self, target_audience):
176         """Create a copy of these credentials with the specified target
177         audience.
178         Args:
179             target_audience (str): The intended audience for these credentials,
180             used when requesting the ID Token.
181         Returns:
182             google.auth.service_account.IDTokenCredentials: A new credentials
183                 instance.
184         """
185         return self.__class__(
186             self._signer,
187             service_account_email=self._service_account_email,
188             token_uri=self._token_uri,
189             target_audience=target_audience,
190             additional_claims=self._additional_claims.copy(),
191         )
192 
193     def _make_authorization_grant_assertion(self):
194         """Create the OAuth 2.0 assertion.
195         This assertion is used during the OAuth 2.0 grant to acquire an
196         ID token.
197         Returns:
198             bytes: The authorization grant assertion.
199         """
200         now = _helpers.utcnow()
201         lifetime = datetime.timedelta(seconds=_DEFAULT_TOKEN_LIFETIME_SECS)
202         expiry = now + lifetime
203 
204         payload = {
205             "iat": _helpers.datetime_to_secs(now),
206             "exp": _helpers.datetime_to_secs(expiry),
207             # The issuer must be the service account email.
208             "iss": self.service_account_email,
209             # The audience must be the auth token endpoint's URI
210             "aud": self._token_uri,
211             # The target audience specifies which service the ID token is
212             # intended for.
213             "target_audience": self._target_audience,
214         }
215 
216         payload.update(self._additional_claims)
217 
218         token = jwt.encode(self._signer, payload)
219 
220         return token
221 
222     @_helpers.copy_docstring(credentials.Credentials)
223     def refresh(self, request):
224         assertion = self._make_authorization_grant_assertion()
225         access_token, expiry, _ = _client.id_token_jwt_grant(
226             request, self._token_uri, assertion
227         )
228         self.token = access_token
229         self.expiry = expiry
230 
231     @property
232     @_helpers.copy_docstring(credentials.Signing)
233     def signer(self):
234         return self._signer
235 
236     @_helpers.copy_docstring(credentials.Signing)
237     def sign_bytes(self, message):
238         return self._signer.sign(message)
239 
240     @property
241     def service_account_email(self):
242         """The service account email."""
243         return self._service_account_email
244 
245     @property
246     def signer_email(self):
247         return self._service_account_email
248
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/google/auth/compute_engine/credentials.py b/google/auth/compute_engine/credentials.py
--- a/google/auth/compute_engine/credentials.py
+++ b/google/auth/compute_engine/credentials.py
@@ -105,7 +105,7 @@
     def service_account_email(self):
         """The service account email.
 
-        .. note: This is not guaranteed to be set until :meth`refresh` has been
+        .. note:: This is not guaranteed to be set until :meth:`refresh` has been
             called.
         """
         return self._service_account_email

{"golden_diff": "diff --git a/google/auth/compute_engine/credentials.py b/google/auth/compute_engine/credentials.py\n--- a/google/auth/compute_engine/credentials.py\n+++ b/google/auth/compute_engine/credentials.py\n@@ -105,7 +105,7 @@\n     def service_account_email(self):\n         \"\"\"The service account email.\n \n-        .. note: This is not guaranteed to be set until :meth`refresh` has been\n+        .. note:: This is not guaranteed to be set until :meth:`refresh` has been\n             called.\n         \"\"\"\n         return self._service_account_email\n", "issue": "Docs: compute_engine.credentials doesn't render note for service_account_email\nOn this doc item: https://google-auth.readthedocs.io/en/latest/reference/google.auth.compute_engine.credentials.html#google.auth.compute_engine.credentials.Credentials.service_account_email\r\n\r\nThe rendered docs say simply `The service account email.`\r\n\r\nHowever, the [docstring](https://google-auth.readthedocs.io/en/latest/_modules/google/auth/compute_engine/credentials.html#Credentials.refresh) has more information:\r\n\r\n```\r\n        \"\"\"The service account email.\r\n\r\n        .. note: This is not guaranteed to be set until :meth`refresh` has been\r\n            called.\r\n        \"\"\"\r\n```\r\n\r\nWhy is this important note not rendered?\n", "before_files": [{"content": "# Copyright 2016 Google Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\n\"\"\"Google Compute Engine credentials.\n\nThis module provides authentication for application running on Google Compute\nEngine using the Compute Engine metadata server.\n\n\"\"\"\n\nimport datetime\n\nimport six\n\nfrom google.auth import _helpers\nfrom google.auth import credentials\nfrom google.auth import exceptions\nfrom google.auth import iam\nfrom google.auth import jwt\nfrom google.auth.compute_engine import _metadata\nfrom google.oauth2 import _client\n\n\nclass Credentials(credentials.ReadOnlyScoped, credentials.Credentials):\n    \"\"\"Compute Engine Credentials.\n\n    These credentials use the Google Compute Engine metadata server to obtain\n    OAuth 2.0 access tokens associated with the instance's service account.\n\n    For more information about Compute Engine authentication, including how\n    to configure scopes, see the `Compute Engine authentication\n    documentation`_.\n\n    .. note:: Compute Engine instances can be created with scopes and therefore\n        these credentials are considered to be 'scoped'. However, you can\n        not use :meth:`~google.auth.credentials.ScopedCredentials.with_scopes`\n        because it is not possible to change the scopes that the instance\n        has. Also note that\n        :meth:`~google.auth.credentials.ScopedCredentials.has_scopes` will not\n        work until the credentials have been refreshed.\n\n    .. _Compute Engine authentication documentation:\n        https://cloud.google.com/compute/docs/authentication#using\n    \"\"\"\n\n    def __init__(self, service_account_email=\"default\"):\n        \"\"\"\n        Args:\n            service_account_email (str): The service account email to use, or\n                'default'. A Compute Engine instance may have multiple service\n                accounts.\n        \"\"\"\n        super(Credentials, self).__init__()\n        self._service_account_email = service_account_email\n\n    def _retrieve_info(self, request):\n        \"\"\"Retrieve information about the service account.\n\n        Updates the scopes and retrieves the full service account email.\n\n        Args:\n            request (google.auth.transport.Request): The object used to make\n                HTTP requests.\n        \"\"\"\n        info = _metadata.get_service_account_info(\n            request, service_account=self._service_account_email\n        )\n\n        self._service_account_email = info[\"email\"]\n        self._scopes = info[\"scopes\"]\n\n    def refresh(self, request):\n        \"\"\"Refresh the access token and scopes.\n\n        Args:\n            request (google.auth.transport.Request): The object used to make\n                HTTP requests.\n\n        Raises:\n            google.auth.exceptions.RefreshError: If the Compute Engine metadata\n                service can't be reached if if the instance has not\n                credentials.\n        \"\"\"\n        try:\n            self._retrieve_info(request)\n            self.token, self.expiry = _metadata.get_service_account_token(\n                request, service_account=self._service_account_email\n            )\n        except exceptions.TransportError as caught_exc:\n            new_exc = exceptions.RefreshError(caught_exc)\n            six.raise_from(new_exc, caught_exc)\n\n    @property\n    def service_account_email(self):\n        \"\"\"The service account email.\n\n        .. note: This is not guaranteed to be set until :meth`refresh` has been\n            called.\n        \"\"\"\n        return self._service_account_email\n\n    @property\n    def requires_scopes(self):\n        \"\"\"False: Compute Engine credentials can not be scoped.\"\"\"\n        return False\n\n\n_DEFAULT_TOKEN_LIFETIME_SECS = 3600  # 1 hour in seconds\n_DEFAULT_TOKEN_URI = \"https://www.googleapis.com/oauth2/v4/token\"\n\n\nclass IDTokenCredentials(credentials.Credentials, credentials.Signing):\n    \"\"\"Open ID Connect ID Token-based service account credentials.\n\n    These credentials relies on the default service account of a GCE instance.\n\n    In order for this to work, the GCE instance must have been started with\n    a service account that has access to the IAM Cloud API.\n    \"\"\"\n\n    def __init__(\n        self,\n        request,\n        target_audience,\n        token_uri=_DEFAULT_TOKEN_URI,\n        additional_claims=None,\n        service_account_email=None,\n    ):\n        \"\"\"\n        Args:\n            request (google.auth.transport.Request): The object used to make\n                HTTP requests.\n            target_audience (str): The intended audience for these credentials,\n                used when requesting the ID Token. The ID Token's ``aud`` claim\n                will be set to this string.\n            token_uri (str): The OAuth 2.0 Token URI.\n            additional_claims (Mapping[str, str]): Any additional claims for\n                the JWT assertion used in the authorization grant.\n            service_account_email (str): Optional explicit service account to\n                use to sign JWT tokens.\n                By default, this is the default GCE service account.\n        \"\"\"\n        super(IDTokenCredentials, self).__init__()\n\n        if service_account_email is None:\n            sa_info = _metadata.get_service_account_info(request)\n            service_account_email = sa_info[\"email\"]\n        self._service_account_email = service_account_email\n\n        self._signer = iam.Signer(\n            request=request,\n            credentials=Credentials(),\n            service_account_email=service_account_email,\n        )\n\n        self._token_uri = token_uri\n        self._target_audience = target_audience\n\n        if additional_claims is not None:\n            self._additional_claims = additional_claims\n        else:\n            self._additional_claims = {}\n\n    def with_target_audience(self, target_audience):\n        \"\"\"Create a copy of these credentials with the specified target\n        audience.\n        Args:\n            target_audience (str): The intended audience for these credentials,\n            used when requesting the ID Token.\n        Returns:\n            google.auth.service_account.IDTokenCredentials: A new credentials\n                instance.\n        \"\"\"\n        return self.__class__(\n            self._signer,\n            service_account_email=self._service_account_email,\n            token_uri=self._token_uri,\n            target_audience=target_audience,\n            additional_claims=self._additional_claims.copy(),\n        )\n\n    def _make_authorization_grant_assertion(self):\n        \"\"\"Create the OAuth 2.0 assertion.\n        This assertion is used during the OAuth 2.0 grant to acquire an\n        ID token.\n        Returns:\n            bytes: The authorization grant assertion.\n        \"\"\"\n        now = _helpers.utcnow()\n        lifetime = datetime.timedelta(seconds=_DEFAULT_TOKEN_LIFETIME_SECS)\n        expiry = now + lifetime\n\n        payload = {\n            \"iat\": _helpers.datetime_to_secs(now),\n            \"exp\": _helpers.datetime_to_secs(expiry),\n            # The issuer must be the service account email.\n            \"iss\": self.service_account_email,\n            # The audience must be the auth token endpoint's URI\n            \"aud\": self._token_uri,\n            # The target audience specifies which service the ID token is\n            # intended for.\n            \"target_audience\": self._target_audience,\n        }\n\n        payload.update(self._additional_claims)\n\n        token = jwt.encode(self._signer, payload)\n\n        return token\n\n    @_helpers.copy_docstring(credentials.Credentials)\n    def refresh(self, request):\n        assertion = self._make_authorization_grant_assertion()\n        access_token, expiry, _ = _client.id_token_jwt_grant(\n            request, self._token_uri, assertion\n        )\n        self.token = access_token\n        self.expiry = expiry\n\n    @property\n    @_helpers.copy_docstring(credentials.Signing)\n    def signer(self):\n        return self._signer\n\n    @_helpers.copy_docstring(credentials.Signing)\n    def sign_bytes(self, message):\n        return self._signer.sign(message)\n\n    @property\n    def service_account_email(self):\n        \"\"\"The service account email.\"\"\"\n        return self._service_account_email\n\n    @property\n    def signer_email(self):\n        return self._service_account_email\n", "path": "google/auth/compute_engine/credentials.py"}], "after_files": [{"content": "# Copyright 2016 Google Inc.\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n#      http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\n\"\"\"Google Compute Engine credentials.\n\nThis module provides authentication for application running on Google Compute\nEngine using the Compute Engine metadata server.\n\n\"\"\"\n\nimport datetime\n\nimport six\n\nfrom google.auth import _helpers\nfrom google.auth import credentials\nfrom google.auth import exceptions\nfrom google.auth import iam\nfrom google.auth import jwt\nfrom google.auth.compute_engine import _metadata\nfrom google.oauth2 import _client\n\n\nclass Credentials(credentials.ReadOnlyScoped, credentials.Credentials):\n    \"\"\"Compute Engine Credentials.\n\n    These credentials use the Google Compute Engine metadata server to obtain\n    OAuth 2.0 access tokens associated with the instance's service account.\n\n    For more information about Compute Engine authentication, including how\n    to configure scopes, see the `Compute Engine authentication\n    documentation`_.\n\n    .. note:: Compute Engine instances can be created with scopes and therefore\n        these credentials are considered to be 'scoped'. However, you can\n        not use :meth:`~google.auth.credentials.ScopedCredentials.with_scopes`\n        because it is not possible to change the scopes that the instance\n        has. Also note that\n        :meth:`~google.auth.credentials.ScopedCredentials.has_scopes` will not\n        work until the credentials have been refreshed.\n\n    .. _Compute Engine authentication documentation:\n        https://cloud.google.com/compute/docs/authentication#using\n    \"\"\"\n\n    def __init__(self, service_account_email=\"default\"):\n        \"\"\"\n        Args:\n            service_account_email (str): The service account email to use, or\n                'default'. A Compute Engine instance may have multiple service\n                accounts.\n        \"\"\"\n        super(Credentials, self).__init__()\n        self._service_account_email = service_account_email\n\n    def _retrieve_info(self, request):\n        \"\"\"Retrieve information about the service account.\n\n        Updates the scopes and retrieves the full service account email.\n\n        Args:\n            request (google.auth.transport.Request): The object used to make\n                HTTP requests.\n        \"\"\"\n        info = _metadata.get_service_account_info(\n            request, service_account=self._service_account_email\n        )\n\n        self._service_account_email = info[\"email\"]\n        self._scopes = info[\"scopes\"]\n\n    def refresh(self, request):\n        \"\"\"Refresh the access token and scopes.\n\n        Args:\n            request (google.auth.transport.Request): The object used to make\n                HTTP requests.\n\n        Raises:\n            google.auth.exceptions.RefreshError: If the Compute Engine metadata\n                service can't be reached if if the instance has not\n                credentials.\n        \"\"\"\n        try:\n            self._retrieve_info(request)\n            self.token, self.expiry = _metadata.get_service_account_token(\n                request, service_account=self._service_account_email\n            )\n        except exceptions.TransportError as caught_exc:\n            new_exc = exceptions.RefreshError(caught_exc)\n            six.raise_from(new_exc, caught_exc)\n\n    @property\n    def service_account_email(self):\n        \"\"\"The service account email.\n\n        .. note:: This is not guaranteed to be set until :meth:`refresh` has been\n            called.\n        \"\"\"\n        return self._service_account_email\n\n    @property\n    def requires_scopes(self):\n        \"\"\"False: Compute Engine credentials can not be scoped.\"\"\"\n        return False\n\n\n_DEFAULT_TOKEN_LIFETIME_SECS = 3600  # 1 hour in seconds\n_DEFAULT_TOKEN_URI = \"https://www.googleapis.com/oauth2/v4/token\"\n\n\nclass IDTokenCredentials(credentials.Credentials, credentials.Signing):\n    \"\"\"Open ID Connect ID Token-based service account credentials.\n\n    These credentials relies on the default service account of a GCE instance.\n\n    In order for this to work, the GCE instance must have been started with\n    a service account that has access to the IAM Cloud API.\n    \"\"\"\n\n    def __init__(\n        self,\n        request,\n        target_audience,\n        token_uri=_DEFAULT_TOKEN_URI,\n        additional_claims=None,\n        service_account_email=None,\n    ):\n        \"\"\"\n        Args:\n            request (google.auth.transport.Request): The object used to make\n                HTTP requests.\n            target_audience (str): The intended audience for these credentials,\n                used when requesting the ID Token. The ID Token's ``aud`` claim\n                will be set to this string.\n            token_uri (str): The OAuth 2.0 Token URI.\n            additional_claims (Mapping[str, str]): Any additional claims for\n                the JWT assertion used in the authorization grant.\n            service_account_email (str): Optional explicit service account to\n                use to sign JWT tokens.\n                By default, this is the default GCE service account.\n        \"\"\"\n        super(IDTokenCredentials, self).__init__()\n\n        if service_account_email is None:\n            sa_info = _metadata.get_service_account_info(request)\n            service_account_email = sa_info[\"email\"]\n        self._service_account_email = service_account_email\n\n        self._signer = iam.Signer(\n            request=request,\n            credentials=Credentials(),\n            service_account_email=service_account_email,\n        )\n\n        self._token_uri = token_uri\n        self._target_audience = target_audience\n\n        if additional_claims is not None:\n            self._additional_claims = additional_claims\n        else:\n            self._additional_claims = {}\n\n    def with_target_audience(self, target_audience):\n        \"\"\"Create a copy of these credentials with the specified target\n        audience.\n        Args:\n            target_audience (str): The intended audience for these credentials,\n            used when requesting the ID Token.\n        Returns:\n            google.auth.service_account.IDTokenCredentials: A new credentials\n                instance.\n        \"\"\"\n        return self.__class__(\n            self._signer,\n            service_account_email=self._service_account_email,\n            token_uri=self._token_uri,\n            target_audience=target_audience,\n            additional_claims=self._additional_claims.copy(),\n        )\n\n    def _make_authorization_grant_assertion(self):\n        \"\"\"Create the OAuth 2.0 assertion.\n        This assertion is used during the OAuth 2.0 grant to acquire an\n        ID token.\n        Returns:\n            bytes: The authorization grant assertion.\n        \"\"\"\n        now = _helpers.utcnow()\n        lifetime = datetime.timedelta(seconds=_DEFAULT_TOKEN_LIFETIME_SECS)\n        expiry = now + lifetime\n\n        payload = {\n            \"iat\": _helpers.datetime_to_secs(now),\n            \"exp\": _helpers.datetime_to_secs(expiry),\n            # The issuer must be the service account email.\n            \"iss\": self.service_account_email,\n            # The audience must be the auth token endpoint's URI\n            \"aud\": self._token_uri,\n            # The target audience specifies which service the ID token is\n            # intended for.\n            \"target_audience\": self._target_audience,\n        }\n\n        payload.update(self._additional_claims)\n\n        token = jwt.encode(self._signer, payload)\n\n        return token\n\n    @_helpers.copy_docstring(credentials.Credentials)\n    def refresh(self, request):\n        assertion = self._make_authorization_grant_assertion()\n        access_token, expiry, _ = _client.id_token_jwt_grant(\n            request, self._token_uri, assertion\n        )\n        self.token = access_token\n        self.expiry = expiry\n\n    @property\n    @_helpers.copy_docstring(credentials.Signing)\n    def signer(self):\n        return self._signer\n\n    @_helpers.copy_docstring(credentials.Signing)\n    def sign_bytes(self, message):\n        return self._signer.sign(message)\n\n    @property\n    def service_account_email(self):\n        \"\"\"The service account email.\"\"\"\n        return self._service_account_email\n\n    @property\n    def signer_email(self):\n        return self._service_account_email\n", "path": "google/auth/compute_engine/credentials.py"}]}