From c5f80666299fd2bbb86a5c4fe35b724a81cad06a Mon Sep 17 00:00:00 2001
From: David Ostrovsky <david@ostrovsky.org>
Date: Thu, 6 Apr 2017 20:25:25 +0200
Subject: [PATCH] Don't ship bouncycastle libraries in plugin API

We cannot shade bouncycastle in the plugin API. Still we need it to be
included in the gerrit.war, licenses file and Eclipse classpath.

Expose bouncycastle libraries in PLUGIN_TEST_DEPS constant, so that
the plugins don't need to change anything in tree build mode.

gerrit_api() bazlet in bazlets repository is extended too, so that the
plugins don't need to change anything in standalone build mode.

One side effect of this change, is that bouncycastle libraries are
now listed with neverlink suffix, e.g.:

* bouncycastle:bcprov-neverlink

Bug: Issue 5826
Change-Id: Idb8051e16b14e20c8dd528783ab297ee25707bb3
---
 gerrit-acceptance-tests/tests.bzl |  2 --
 gerrit-gpg/BUILD                  |  8 ++++----
 gerrit-server/BUILD               |  5 +++--
 gerrit-sshd/BUILD                 |  2 +-
 lib/bouncycastle/BUILD            | 24 ++++++++++++++++++++++++
 tools/bzl/pkg_war.bzl             |  3 +++
 tools/bzl/plugin.bzl              |  7 ++++++-
 7 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/gerrit-acceptance-tests/tests.bzl b/gerrit-acceptance-tests/tests.bzl
index 3b1a4f4be6..594e58394d 100644
--- a/gerrit-acceptance-tests/tests.bzl
+++ b/gerrit-acceptance-tests/tests.bzl
@@ -10,8 +10,6 @@ def acceptance_tests(
     name = group,
     deps = deps + [
       '//gerrit-acceptance-tests:lib',
-      "//lib/bouncycastle:bcpkix",
-      "//lib/bouncycastle:bcpg",
     ],
     tags = labels + [
       'acceptance',
diff --git a/gerrit-gpg/BUILD b/gerrit-gpg/BUILD
index 1d949d15d8..680071f3da 100644
--- a/gerrit-gpg/BUILD
+++ b/gerrit-gpg/BUILD
@@ -19,8 +19,8 @@ java_library(
     srcs = glob(["src/main/java/**/*.java"]),
     visibility = ["//visibility:public"],
     deps = DEPS + [
-        "//lib/bouncycastle:bcpg",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpg-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
     ],
 )
 
@@ -32,9 +32,9 @@ java_library(
     srcs = TESTUTIL_SRCS,
     visibility = ["//visibility:public"],
     deps = DEPS + [
+        "//lib/bouncycastle:bcpg-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
         ":gpg",
-        "//lib/bouncycastle:bcpg",
-        "//lib/bouncycastle:bcprov",
     ],
 )
 
diff --git a/gerrit-server/BUILD b/gerrit-server/BUILD
index a8ac50d759..adfe7a46b1 100644
--- a/gerrit-server/BUILD
+++ b/gerrit-server/BUILD
@@ -55,8 +55,8 @@ java_library(
         "//lib:velocity",
         "//lib/antlr:java_runtime",
         "//lib/auto:auto-value",
-        "//lib/bouncycastle:bcpkix",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpkix-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
         "//lib/commons:codec",
         "//lib/commons:compress",
         "//lib/commons:dbcp",
@@ -230,6 +230,7 @@ junit_tests(
         "//lib:guava-retrying",
         "//lib:protobuf",
         "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpkix",
         "//lib/dropwizard:dropwizard-core",
         "//lib/guice:guice-assistedinject",
         "//lib/prolog:runtime",
diff --git a/gerrit-sshd/BUILD b/gerrit-sshd/BUILD
index 2288e5d3bf..db27f02597 100644
--- a/gerrit-sshd/BUILD
+++ b/gerrit-sshd/BUILD
@@ -23,7 +23,7 @@ java_library(
         "//lib:jsch",
         "//lib:servlet-api-3_1",
         "//lib/auto:auto-value",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcprov-neverlink",
         "//lib/commons:codec",
         "//lib/dropwizard:dropwizard-core",
         "//lib/guice",
diff --git a/lib/bouncycastle/BUILD b/lib/bouncycastle/BUILD
index 746a982cff..cf3e996263 100644
--- a/lib/bouncycastle/BUILD
+++ b/lib/bouncycastle/BUILD
@@ -18,3 +18,27 @@ java_library(
     visibility = ["//visibility:public"],
     exports = ["@bcpkix//jar"],
 )
+
+java_library(
+    name = "bcprov-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcprov//jar"],
+)
+
+java_library(
+    name = "bcpg-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcpg//jar"],
+)
+
+java_library(
+    name = "bcpkix-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcpkix//jar"],
+)
diff --git a/tools/bzl/pkg_war.bzl b/tools/bzl/pkg_war.bzl
index 7eebcd3d82..edaaab044a 100644
--- a/tools/bzl/pkg_war.bzl
+++ b/tools/bzl/pkg_war.bzl
@@ -21,6 +21,9 @@ LIBS = [
     "//gerrit-war:log4j-config",
     "//gerrit-war:version",
     "//lib:postgresql",
+    "//lib/bouncycastle:bcpkix",
+    "//lib/bouncycastle:bcprov",
+    "//lib/bouncycastle:bcpg",
     "//lib/log:impl_log4j",
 ]
 
diff --git a/tools/bzl/plugin.bzl b/tools/bzl/plugin.bzl
index de82af804d..59e7335e59 100644
--- a/tools/bzl/plugin.bzl
+++ b/tools/bzl/plugin.bzl
@@ -12,7 +12,12 @@ load(
 
 PLUGIN_DEPS = ["//gerrit-plugin-api:lib"]
 
-PLUGIN_TEST_DEPS = ["//gerrit-acceptance-framework:lib"]
+PLUGIN_TEST_DEPS = [
+    "//gerrit-acceptance-framework:lib",
+    "//lib/bouncycastle:bcpg",
+    "//lib/bouncycastle:bcpkix",
+    "//lib/bouncycastle:bcprov",
+]
 
 def gerrit_plugin(
     name,