samples: add samples for bucket encryption enforcement config

Co-authored-by: nidhiii-27 <224584462+nidhiii-27@users.noreply.github.com>

Author: google-labs-jules[bot]

.librarian/state.yaml

@@ -1,7 +1,7 @@
 image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:8e2c32496077054105bd06c54a59d6a6694287bc053588e24debe6da6920ad91
 libraries:
   - id: google-cloud-storage
-    version: 3.10.1
+    version: 3.9.0
     last_generated_commit: 5400ccce473c439885bd6bf2924fd242271bfcab
     apis:
       - path: google/storage/v2

CHANGELOG.md

@@ -4,34 +4,6 @@
 
 [1]: https://pypi.org/project/google-cloud-storage/#history
 
-## [3.10.1](https://github.com/googleapis/python-storage/compare/v3.10.0...v3.10.1) (2026-03-23)
-
-
-### Bug Fixes
-
-* raise ValueError if api_endpoint is unset when using AnonymousCredentials in AsyncGrpcClient.  (#1778) ([17828ea316872938a98a6360b10a2495c54bbbcb](https://github.com/googleapis/python-storage/commit/17828ea316872938a98a6360b10a2495c54bbbcb))
-
-## [3.10.0](https://github.com/googleapis/python-storage/compare/v3.9.0...v3.10.0) (2026-03-18)
-
-
-### Features
-
-* [Bucket Encryption Enforcement] add support for bucket encryption enforcement config (#1742) ([2a6e8b00e4e6ff57460373f8e628fd363be47811](https://github.com/googleapis/python-storage/commit/2a6e8b00e4e6ff57460373f8e628fd363be47811))
-
-### Perf Improvments
-
-* [Rapid Buckets Reads] Use raw proto access for read resumption strategy (#1764) ([14cfd61ce35365a409650981239ef742cdf375fb](https://github.com/googleapis/python-storage/commit/14cfd61ce35365a409650981239ef742cdf375fb))
-* [Rapid Buckets Benchmarks] init mp pool & grpc client once, use os.sched_setaffinity (#1751) ([a9eb82c1b9b3c6ae5717d47b76284ed0deb5f769](https://github.com/googleapis/python-storage/commit/a9eb82c1b9b3c6ae5717d47b76284ed0deb5f769))
-* [Rapid Buckets Writes] don't flush at every append, results in bad perf (#1746) ([ab62d728ac7d7be3c4fe9a99d72e35ead310805a](https://github.com/googleapis/python-storage/commit/ab62d728ac7d7be3c4fe9a99d72e35ead310805a))
-
-
-### Bug Fixes
-
-* [Windows] skip downloading blobs whose name contain `":" ` eg: `C:` `D:` etc when application runs in Windows. (#1774) ([558198823ed51918db9c0137715d1e7f5b593975](https://github.com/googleapis/python-storage/commit/558198823ed51918db9c0137715d1e7f5b593975))
-* [Path Traversal] Prevent path traversal in `download_many_to_path` (#1768) ([700fec3bf7aa37bd5ea4b163cc3f9e8e6892bd5a](https://github.com/googleapis/python-storage/commit/700fec3bf7aa37bd5ea4b163cc3f9e8e6892bd5a))
-* [Rapid Buckets] pass token correctly, '&' instead of ',' (#1756) ([d8dd1e074d2431de9b45e0103181dce749a447a0](https://github.com/googleapis/python-storage/commit/d8dd1e074d2431de9b45e0103181dce749a447a0))
-
-
 ## [3.9.0](https://github.com/googleapis/python-storage/compare/v3.8.0...v3.9.0) (2026-02-02)
 
 

google/cloud/_storage_v2/gapic_version.py

@@ -13,4 +13,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-__version__ = "3.10.1"  # {x-release-please-version}
+__version__ = "3.9.0"  # {x-release-please-version}

google/cloud/storage/asyncio/async_grpc_client.py

@@ -55,10 +55,6 @@ def __init__(
         attempt_direct_path=True,
     ):
         if isinstance(credentials, auth_credentials.AnonymousCredentials):
-            if client_options is None or client_options.api_endpoint is None:
-                raise ValueError(
-                    "Either client_options or `client_option.api_endpoint` is None. Please provide api_endpoint when `AnonymousCredentials` is used "
-                )
             self._grpc_client = self._create_anonymous_client(
                 client_options, credentials
             )

google/cloud/storage/asyncio/retry/reads_resumption_strategy.py

@@ -81,28 +81,23 @@ def update_state_from_response(
         self, response: storage_v2.BidiReadObjectResponse, state: Dict[str, Any]
     ) -> None:
         """Processes a server response, performs integrity checks, and updates state."""
-        proto = getattr(response, "_pb", response)
 
         # Capture read_handle if provided.
-        if proto.HasField("read_handle"):
-            state["read_handle"] = storage_v2.BidiReadHandle(
-                handle=proto.read_handle.handle
-            )
+        if response.read_handle:
+            state["read_handle"] = response.read_handle
 
         download_states = state["download_states"]
 
-        for object_data_range in proto.object_data_ranges:
+        for object_data_range in response.object_data_ranges:
             # Ignore empty ranges or ranges for IDs not in our state
             # (e.g., from a previously cancelled request on the same stream).
-            if not object_data_range.HasField("read_range"):
+            if not object_data_range.read_range:
                 logger.warning(
                     "Received response with missing read_range field; ignoring."
                 )
                 continue
 
-            read_range_pb = object_data_range.read_range
-            read_id = read_range_pb.read_id
-
+            read_id = object_data_range.read_range.read_id
             if read_id not in download_states:
                 logger.warning(
                     f"Received data for unknown or stale read_id {read_id}; ignoring."
@@ -112,8 +107,7 @@ def update_state_from_response(
             read_state = download_states[read_id]
 
             # Offset Verification
-            # We must validate data before updating state or writing to buffer.
-            chunk_offset = read_range_pb.read_offset
+            chunk_offset = object_data_range.read_range.read_offset
             if chunk_offset != read_state.next_expected_offset:
                 raise DataCorruption(
                     response,
@@ -122,11 +116,11 @@ def update_state_from_response(
                 )
 
             # Checksum Verification
-            checksummed_data = object_data_range.checksummed_data
-            data = checksummed_data.content
+            # We must validate data before updating state or writing to buffer.
+            data = object_data_range.checksummed_data.content
+            server_checksum = object_data_range.checksummed_data.crc32c
 
-            if checksummed_data.HasField("crc32c"):
-                server_checksum = checksummed_data.crc32c
+            if server_checksum is not None:
                 client_checksum = int.from_bytes(Checksum(data).digest(), "big")
                 if server_checksum != client_checksum:
                     raise DataCorruption(

google/cloud/storage/exceptions.py

@@ -33,12 +33,6 @@
     DataCorruptionDynamicParent = Exception
 
 
-class InvalidPathError(Exception):
-    """Raised when the provided path string is malformed."""
-
-    pass
-
-
 class InvalidResponse(InvalidResponseDynamicParent):
     """Error class for responses which are not in the correct state.
 

google/cloud/storage/transfer_manager.py

@@ -39,7 +39,7 @@
 
 from google.cloud.storage._media.requests.upload import XMLMPUContainer
 from google.cloud.storage._media.requests.upload import XMLMPUPart
-from google.cloud.storage.exceptions import DataCorruption, InvalidPathError
+from google.cloud.storage.exceptions import DataCorruption
 
 TM_DEFAULT_CHUNK_SIZE = 32 * 1024 * 1024
 DEFAULT_MAX_WORKERS = 8
@@ -263,8 +263,6 @@ def upload_many(
 
 
 def _resolve_path(target_dir, blob_path):
-    if os.name == "nt" and ":" in blob_path:
-        raise InvalidPathError(f"{blob_path} cannot be downloaded into {target_dir}")
     target_dir = Path(target_dir)
     blob_path = Path(blob_path)
     # blob_path.anchor will be '/' if `blob_path` is full path else it'll empty.
@@ -807,65 +805,43 @@ def download_many_to_path(
 
     :raises: :exc:`concurrent.futures.TimeoutError` if deadline is exceeded.
 
-    :rtype: List[None|Exception|UserWarning]
+    :rtype: list
     :returns: A list of results corresponding to, in order, each item in the
-        input list. If an exception was received or a download was skipped
-        (e.g., due to existing file or path traversal), it will be the result
-        for that operation (as an Exception or UserWarning, respectively).
-        Otherwise, the result will be None for a successful download.
+        input list. If an exception was received, it will be the result
+        for that operation. Otherwise, the return value from the successful
+        download method is used (which will be None).
     """
-    results = [None] * len(blob_names)
     blob_file_pairs = []
-    indices_to_process = []
 
-    for i, blob_name in enumerate(blob_names):
+    for blob_name in blob_names:
         full_blob_name = blob_name_prefix + blob_name
-        try:
-            resolved_path = _resolve_path(destination_directory, blob_name)
-        except InvalidPathError as e:
-            msg = f"The blob {blob_name} will **NOT** be downloaded. {e}"
-            warnings.warn(msg)
-            results[i] = UserWarning(msg)
-            continue
+        resolved_path = _resolve_path(destination_directory, blob_name)
         if not resolved_path.parent.is_relative_to(
             Path(destination_directory).resolve()
         ):
-            msg = (
+            warnings.warn(
                 f"The blob {blob_name} will **NOT** be downloaded. "
                 f"The resolved destination_directory - {resolved_path.parent} - is either invalid or "
                 f"escapes user provided {Path(destination_directory).resolve()} . Please download this file separately using `download_to_filename`"
             )
-            warnings.warn(msg)
-            results[i] = UserWarning(msg)
             continue
 
         resolved_path = str(resolved_path)
-        if skip_if_exists and os.path.isfile(resolved_path):
-            msg = f"The blob {blob_name} is skipped because destination file already exists"
-            results[i] = UserWarning(msg)
-            continue
-
         if create_directories:
             directory, _ = os.path.split(resolved_path)
             os.makedirs(directory, exist_ok=True)
         blob_file_pairs.append((bucket.blob(full_blob_name), resolved_path))
-        indices_to_process.append(i)
 
-    many_results = download_many(
+    return download_many(
         blob_file_pairs,
         download_kwargs=download_kwargs,
         deadline=deadline,
         raise_exception=raise_exception,
         worker_type=worker_type,
         max_workers=max_workers,
-        skip_if_exists=False, # skip_if_exists is handled in the loop above
+        skip_if_exists=skip_if_exists,
     )
 
-    for meta_index, result in zip(indices_to_process, many_results):
-        results[meta_index] = result
-
-    return results
-
 
 def download_chunks_concurrently(
     blob,

google/cloud/storage/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "3.10.1"
+__version__ = "3.9.0"

noxfile.py

@@ -44,7 +44,6 @@
 nox.options.sessions = [
     "blacken",
     "conftest_retry",
-    "conftest_retry_bidi",
     "docfx",
     "docs",
     "lint",
@@ -222,9 +221,10 @@ def system(session):
 @nox.session(python=CONFORMANCE_TEST_PYTHON_VERSIONS)
 def conftest_retry(session):
     """Run the retry conformance test suite."""
-    json_conformance_tests = "tests/conformance/test_conformance.py"
+    conformance_test_folder_path = os.path.join("tests", "conformance")
+    conformance_test_folder_exists = os.path.exists(conformance_test_folder_path)
     # Environment check: only run tests if found.
-    if not os.path.exists(json_conformance_tests):
+    if not conformance_test_folder_exists:
         session.skip("Conformance tests were not found")
 
     constraints_path = str(
@@ -236,6 +236,10 @@ def conftest_retry(session):
     session.install(
         "pytest",
         "pytest-xdist",
+        "pytest-asyncio",
+        "grpcio",
+        "grpcio-status",
+        "grpc-google-iam-v1",
         "-c",
         constraints_path,
     )
@@ -247,52 +251,17 @@ def conftest_retry(session):
             "pytest",
             "-vv",
             "-s",
-            json_conformance_tests,
+            # "--quiet",
+            conformance_test_folder_path,
             *session.posargs,
         ]
     else:
-        test_cmd = ["pytest", "-vv", "-s", "-n", "auto", json_conformance_tests]
+        test_cmd = ["pytest", "-vv", "-s", "-n", "auto", conformance_test_folder_path]
 
-    # Run pytest against the conformance tests.
+    # Run py.test against the conformance tests.
     session.run(*test_cmd, env={"DOCKER_API_VERSION": "1.39"})
 
 
-@nox.session(python=CONFORMANCE_TEST_PYTHON_VERSIONS)
-def conftest_retry_bidi(session):
-    """Run the retry conformance test suite."""
-
-    constraints_path = str(
-        CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
-    )
-
-    # Install all test dependencies and pytest plugin to run tests in parallel.
-    # Then install this package in-place.
-    session.install(
-        "pytest",
-        "pytest-xdist",
-        "pytest-asyncio",
-        "grpcio",
-        "grpcio-status",
-        "grpc-google-iam-v1",
-        "-c",
-        constraints_path,
-    )
-    session.install("-e", ".", "-c", constraints_path)
-
-    bidi_tests = [
-        "tests/conformance/test_bidi_reads.py",
-        "tests/conformance/test_bidi_writes.py",
-    ]
-    for test_file in bidi_tests:
-        session.run(
-            "pytest",
-            "-vv",
-            "-s",
-            test_file,
-            env={"DOCKER_API_VERSION": "1.39"},
-        )
-
-
 @nox.session(python=DEFAULT_PYTHON_VERSION)
 def cover(session):
     """Run the final coverage report.

samples/generated_samples/snippet_metadata_google.storage.v2.json

@@ -8,7 +8,7 @@
     ],
     "language": "PYTHON",
     "name": "google-cloud-storage",
-    "version": "3.10.1"
+    "version": "3.9.0"
   },
   "snippets": [
     {