def _verify_signed_jwt_with_certs(<EOL>jwt, time_now, cache,<EOL>cert_uri=_DEFAULT_CERT_URI):
segments = jwt.split('<STR_LIT:.>')<EOL>if len(segments) != <NUM_LIT:3>:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT>signed = '<STR_LIT>' % (segments[<NUM_LIT:0>], segments[<NUM_LIT:1>])<EOL>signature = _urlsafe_b64decode(segments[<NUM_LIT:2>])<EOL>lsignature = int(signature.encode('<STR_LIT>'), <NUM_LIT:16>)<EOL>header_body = _urlsafe_b64decode(segments[<NUM_LIT:0>])<EOL>try:<EOL><INDENT>header = json.loads(header_body)<EOL><DEDENT>except:<EOL><INDENT>raise _AppIdentityError("<STR_LIT>")<EOL><DEDENT>if header.get('<STR_LIT>') != '<STR_LIT>':<EOL><INDENT>raise _AppIdentityError('<STR_LIT>' %<EOL>header.get('<STR_LIT>'))<EOL><DEDENT>certs = _get_cached_certs(cert_uri, cache)<EOL>if certs is None:<EOL><INDENT>raise _AppIdentityError(<EOL>'<STR_LIT>')<EOL><DEDENT>if not _CRYPTO_LOADED:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>'<EOL>'<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT>local_hash = SHA256.new(signed).hexdigest()<EOL>verified = False<EOL>for keyvalue in certs['<STR_LIT>']:<EOL><INDENT>try:<EOL><INDENT>modulus = _b64_to_long(keyvalue['<STR_LIT>'])<EOL>exponent = _b64_to_long(keyvalue['<STR_LIT>'])<EOL>key = RSA.construct((modulus, exponent))<EOL>hexsig = '<STR_LIT>' % key.encrypt(lsignature, '<STR_LIT>')[<NUM_LIT:0>]<EOL>hexsig = hexsig[-<NUM_LIT:64>:]<EOL>verified = hmac.compare_digest(hexsig, local_hash)<EOL>if verified:<EOL><INDENT>break<EOL><DEDENT><DEDENT>except Exception as e:  <EOL><INDENT>_logger.debug(<EOL>'<STR_LIT>', e)<EOL>continue<EOL><DEDENT><DEDENT>if not verified:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>')<EOL><DEDENT>json_body = _urlsafe_b64decode(segments[<NUM_LIT:1>])<EOL>try:<EOL><INDENT>parsed = json.loads(json_body)<EOL><DEDENT>except:<EOL><INDENT>raise _AppIdentityError("<STR_LIT>")<EOL><DEDENT>iat = parsed.get('<STR_LIT>')<EOL>if iat is None:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>')<EOL><DEDENT>earliest = iat - _CLOCK_SKEW_SECS<EOL>exp = parsed.get('<STR_LIT>')<EOL>if exp is None:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>')<EOL><DEDENT>if exp >= time_now + _MAX_TOKEN_LIFETIME_SECS:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>')<EOL><DEDENT>latest = exp + _CLOCK_SKEW_SECS<EOL>if time_now < earliest:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>' %<EOL>(time_now, earliest))<EOL><DEDENT>if time_now > latest:<EOL><INDENT>raise _AppIdentityError('<STR_LIT>' %<EOL>(time_now, latest))<EOL><DEDENT>return parsed<EOL>
Verify a JWT against public certs.

    See http://self-issued.info/docs/draft-jones-json-web-token.html.

    The PyCrypto library included with Google App Engine is severely limited and
    so you have to use it very carefully to verify JWT signatures. The first
    issue is that the library can't read X.509 files, so we make a call to a
    special URI that has the public cert in modulus/exponent form in JSON.

    The second issue is that the RSA.verify method doesn't work, at least for
    how the JWT tokens are signed, so we have to manually verify the signature
    of the JWT, which means hashing the signed part of the JWT and comparing
    that to the signature that's been encrypted with the public key.

    Args:
      jwt: string, A JWT.
      time_now: The current time, as a long (eg. long(time.time())).
      cache: Cache to use (eg. the memcache module).
      cert_uri: string, URI to get cert modulus and exponent in JSON format.

    Returns:
      dict, The deserialized JSON payload in the JWT.

    Raises:
      _AppIdentityError: if any checks are failed.