Add dual read for ReservedList (#423 )

* Add dual read for ReservedList * Extract loading cloud sql list to a method
Remove MapUserTypeTest from Integration TestSuite (#449 )
2026-05-22 07:41:50 +00:00 · 2020-01-17 15:49:58 -05:00 · 2020-01-17 14:14:14 -05:00 · 2020-01-16 14:56:41 -05:00 · 2020-01-15 16:43:39 -05:00 · 2020-01-15 13:10:50 -05:00
588 changed files with 7379 additions and 3261 deletions
--- a/appengine_war.gradle
+++ b/appengine_war.gradle
@@ -81,7 +81,7 @@ appengine {
 }

 dependencies {
-    compile project(':core')
+    compile project(path: ':core', configuration: 'deploy_jar')
 }

 // The tools.jar file gets pulled in from the java environment and for some
--- a/build.gradle
+++ b/build.gradle
@@ -179,6 +179,16 @@ allprojects {
      mavenCentral()
    }
  }
+
+  if (rootProject.enableCrossReferencing.toBoolean()) {
+    gradle.projectsEvaluated {
+      tasks.withType(JavaCompile) {
+        options.fork = true
+        options.forkOptions.executable =
+            "${project.rootDir}/kythe/extractors/javac-wrapper.sh"
+      }
+    }
+  }
 }

 task runPresubmits(type: Exec) {
@@ -190,24 +200,33 @@ subprojects {
  // Skip no-op project
  if (project.name == 'services') return

-  ext.createUberJar = { taskName, binaryName, mainClass ->
+  ext.createUberJar = {
+      taskName,
+      binaryName,
+      mainClass,
+      List<Configuration> configs = [project.configurations.runtimeClasspath],
+      List<SourceSetOutput> srcOutput = [project.sourceSets.main.output],
+      List<String> excludes = [] ->
    project.tasks.create(
-      taskName, com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar) {
+        taskName, com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar) {
      mergeServiceFiles()
      baseName = binaryName
-      manifest {
-        attributes 'Main-Class': mainClass
+      if (mainClass != '') {
+        manifest {
+          attributes 'Main-Class': mainClass
+        }
      }
      zip64 = true
      classifier = ''
      archiveVersion = ''
-      configurations = [project.configurations.runtimeClasspath]
-      from project.sourceSets.main.output
+      configurations = configs
+      from srcOutput
      // Excludes signature files that accompany some dependency jars, like
      // bonuncycastle. If they are present, only classes from those signed jars are
      // made available to the class loader.
      // see https://discuss.gradle.org/t/signing-a-custom-gradle-plugin-thats-downloaded-by-the-build-system-from-github/1365
      exclude "META-INF/*.SF", "META-INF/*.DSA", "META-INF/*.RSA"
+      exclude excludes
    }
  }

@@ -221,9 +240,18 @@ subprojects {
  }

  afterEvaluate {
-    if (rootProject.enableDependencyLocking.toBoolean()) {
-      // Lock application dependencies except for the gradle-license-report
-      // plugin. See dependency_lic.gradle for the reason why.
+    if (rootProject.enableDependencyLocking.toBoolean()
+        && project.name != 'integration') {
+      // The ':integration' project runs server/schema integration tests using
+      // dynamically specified jars with no transitive dependency. Therefore
+      // dependency-locking does not make sense. Furthermore, during
+      // evaluation it resolves the 'testRuntime' configuration, making it
+      // immutable. Locking activation would trigger an invalid operation
+      // exception.
+      //
+      // For all other projects, due to problem with the gradle-license-report
+      // plugin, the dependencyLicenseReport configuration must opt out of
+      // dependency-locking. See dependency_lic.gradle for the reason why.
      //
      // To selectively activate dependency locking without hardcoding them
      // in the 'configurations' block, the following code must run after
--- a/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
+++ b/buildSrc/gradle/dependency-locks/deploy_jar.lockfile
@@ -0,0 +1,61 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+com.fasterxml.jackson.core:jackson-core:2.9.9
+com.google.api-client:google-api-client:1.27.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-httpjson:0.52.1
+com.google.api:gax:1.35.1
+com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.cloud:google-cloud-core-http:1.59.0
+com.google.cloud:google-cloud-core:1.59.0
+com.google.cloud:google-cloud-storage:1.59.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.7
+com.google.common.html.types:types:1.0.4
+com.google.errorprone:error_prone_annotations:2.3.2
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.0-beta1
+com.google.http-client:google-http-client-appengine:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.oauth-client:google-oauth-client:1.27.0
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.template:soy:2018-03-14
+com.ibm.icu:icu4j:57.1
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+javax.annotation:javax.annotation-api:1.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.validation:validation-api:1.0.0.GA
+joda-time:joda-time:2.9.2
+org.apache.commons:commons-lang3:3.8.1
+org.apache.commons:commons-text:1.6
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.json:json:20160212
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.threeten:threetenbp:1.3.3
--- a/buildSrc/gradle/dependency-locks/testCompile.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompile.lockfile
@@ -49,7 +49,7 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.7
 org.apache.commons:commons-lang3:3.8.1
--- a/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -49,7 +49,7 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.7
 org.apache.commons:commons-lang3:3.8.1
--- a/buildSrc/gradle/dependency-locks/testRuntime.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntime.lockfile
@@ -49,7 +49,7 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.7
 org.apache.commons:commons-lang3:3.8.1
--- a/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -49,7 +49,7 @@ javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
 javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.7
 org.apache.commons:commons-lang3:3.8.1
--- a/common/build.gradle
+++ b/common/build.gradle
@@ -19,12 +19,21 @@ sourceSets {
      runtimeClasspath += main.output
    }
  }
+  test {
+    java {
+      compileClasspath += testing.output
+      runtimeClasspath += testing.output
+    }
+  }
 }

 configurations {
  testingCompile.extendsFrom compile
  testingRuntime.extendsFrom runtime

+  testCompile.extendsFrom testingCompile
+  testRuntime.extendsFrom testingRuntime
+
  // All testing util classes. Other projects may declare dependency as:
  // testCompile project(path: 'common', configuration: 'testing')
  testing
@@ -49,4 +58,8 @@ dependencies {

  testingCompile deps['com.google.flogger:flogger']
  testingRuntime deps['com.google.flogger:flogger-system-backend']
+  testingCompile deps['com.google.truth:truth']
+  testingCompile deps['io.github.java-diff-utils:java-diff-utils']
+
+  testCompile deps['junit:junit']
 }
--- a/third_party/gradle/dependency-locks/checkstyle.lockfile
+++ b/third_party/gradle/dependency-locks/checkstyle.lockfile
@@ -1,18 +1,13 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-antlr:antlr:2.7.7
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.guava:failureaccess:1.0.1
-com.google.guava:guava:28.0-jre
+com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
-com.puppycrawl.tools:checkstyle:8.24
-commons-beanutils:commons-beanutils:1.9.4
-commons-collections:commons-collections:3.2.2
-info.picocli:picocli:4.0.3
-net.sf.saxon:Saxon-HE:9.9.1-4
-org.antlr:antlr4-runtime:4.7.2
+javax.inject:javax.inject:1
+joda-time:joda-time:2.9.2
 org.checkerframework:checker-qual:2.8.1
-org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.mojo:animal-sniffer-annotations:1.18
--- a/common/gradle/dependency-locks/testCompile.lockfile
+++ b/common/gradle/dependency-locks/testCompile.lockfile
@@ -1,13 +1,22 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.13
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -1,13 +1,22 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.13
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testRuntime.lockfile
+++ b/common/gradle/dependency-locks/testRuntime.lockfile
@@ -1,13 +1,23 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger-system-backend:0.1
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.13
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -1,13 +1,23 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
+com.google.flogger:flogger-system-backend:0.1
+com.google.flogger:flogger:0.1
 com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.13
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingCompile.lockfile
+++ b/common/gradle/dependency-locks/testingCompile.lockfile
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger:0.1
@@ -8,7 +9,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingCompileClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingCompileClasspath.lockfile
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger:0.1
@@ -8,7 +9,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntime.lockfile
+++ b/common/gradle/dependency-locks/testingRuntime.lockfile
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger-system-backend:0.1
@@ -9,7 +10,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
+++ b/common/gradle/dependency-locks/testingRuntimeClasspath.lockfile
@@ -1,6 +1,7 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
+com.google.auto.value:auto-value-annotations:1.6.3
 com.google.code.findbugs:jsr305:3.0.2
 com.google.errorprone:error_prone_annotations:2.3.2
 com.google.flogger:flogger-system-backend:0.1
@@ -9,7 +10,14 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:28.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.3
+com.google.truth:truth:1.0
+com.googlecode.java-diff-utils:diffutils:1.3.0
+io.github.java-diff-utils:java-diff-utils:4.0
 javax.inject:javax.inject:1
 joda-time:joda-time:2.9.2
+junit:junit:4.12
+org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.8.1
 org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
+org.hamcrest:hamcrest-core:1.3
--- a/common/src/test/java/google/registry/testing/truth/TextDiffSubjectTest.java
+++ b/common/src/test/java/google/registry/testing/truth/TextDiffSubjectTest.java
@@ -12,17 +12,17 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-package google.registry.testing;
+package google.registry.testing.truth;

 import static com.google.common.io.Resources.getResource;
 import static com.google.common.truth.Truth.assertThat;
-import static google.registry.testing.JUnitBackports.assertThrows;
-import static google.registry.testing.TextDiffSubject.assertThat;
+import static google.registry.testing.truth.TextDiffSubject.assertThat;
+import static org.junit.Assert.assertThrows;

 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
 import com.google.common.io.Resources;
-import google.registry.testing.TextDiffSubject.DiffFormat;
+import google.registry.testing.truth.TextDiffSubject.DiffFormat;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import org.junit.Test;
@@ -33,15 +33,15 @@ import org.junit.runners.JUnit4;
@RunWith(JUnit4.class)
 public class TextDiffSubjectTest {

+  private static final String RESOURCE_FOLDER = "google/registry/testing/truth/";
  // Resources for input data.
-  private static final String ACTUAL_RESOURCE = "google/registry/testing/text-diff-actual.txt";
-  private static final String EXPECTED_RESOURCE = "google/registry/testing/text-diff-expected.txt";
+  private static final String ACTUAL_RESOURCE = RESOURCE_FOLDER + "text-diff-actual.txt";
+  private static final String EXPECTED_RESOURCE = RESOURCE_FOLDER + "text-diff-expected.txt";

  // Resources for expected diff texts.
-  private static final String UNIFIED_DIFF_RESOURCE =
-      "google/registry/testing/text-unified-diff.txt";
+  private static final String UNIFIED_DIFF_RESOURCE = RESOURCE_FOLDER + "text-unified-diff.txt";
  private static final String SIDE_BY_SIDE_DIFF_RESOURCE =
-      "google/registry/testing/text-sidebyside-diff.txt";
+      RESOURCE_FOLDER + "text-sidebyside-diff.txt";

  @Test
  public void unifiedDiff_equal() throws IOException {
--- a/common/src/test/resources/google/registry/testing/truth/text-diff-actual.txt
+++ b/common/src/test/resources/google/registry/testing/truth/text-diff-actual.txt
--- a/common/src/test/resources/google/registry/testing/truth/text-diff-expected.txt
+++ b/common/src/test/resources/google/registry/testing/truth/text-diff-expected.txt
--- a/common/src/test/resources/google/registry/testing/truth/text-sidebyside-diff.txt
+++ b/common/src/test/resources/google/registry/testing/truth/text-sidebyside-diff.txt
--- a/common/src/test/resources/google/registry/testing/truth/text-unified-diff.txt
+++ b/common/src/test/resources/google/registry/testing/truth/text-unified-diff.txt
--- a/common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java
+++ b/common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-package google.registry.testing;
+package google.registry.testing.truth;

 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.truth.Truth.assertAbout;
--- a/config/checkstyle/checkstyle.xml
+++ b/config/checkstyle/checkstyle.xml
@@ -55,12 +55,6 @@ by Joshua Bloch in his book Effective Java -->
    <property name="message" value="Use java.util.Optional instead of Guava's Optional."/>
  </module>

-  <!-- Checks that our backport JUnit exception assertion methods are used instead of the ones slated for release in JUnit 4.13. -->
-  <module name="RegexpSingleline">
-    <property name="format" value="org\.junit\.Assert\.(assert|expect)Throws"/>
-    <property name="message" value="Use the exception assertion methods in google.registry.testing.JUnitBackports instead of those in JUnit."/>
-  </module>
-
  <!-- Checks that the deprecated ExpectedException is not used. -->
  <module name="RegexpSingleline">
    <property name="format" value="org\.junit\.rules\.ExpectedException"/>
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -12,8 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+import java.lang.reflect.Constructor
+import java.util.Optional
+
 plugins {
  id 'java-library'
+  id 'maven-publish'
 }

 // Path to code generated by ad hoc tasks in this project. A separate path is
@@ -86,8 +90,17 @@ sourceSets {
      exclude '**/*.xjb'
    }
  }
+  nonprod {
+    java {
+      compileClasspath += main.output
+      runtimeClasspath += main.output
+    }
+  }
  test {
    java {
+      compileClasspath += nonprod.output
+      runtimeClasspath += nonprod.output
+
      // Javadoc API is deprecated in Java 11 and removed in Java 12.
      // TODO(jianglai): re-enable after migrating to the new Javadoc API
      if ((JavaVersion.current().majorVersion as Integer) >= 11) {
@@ -109,6 +122,18 @@ configurations {
  jaxb
  soy
  closureCompiler
+  devtool
+
+  nonprodCompile.extendsFrom compile
+  nonprodRuntime.extendsFrom runtime
+
+  testCompile.extendsFrom nonprodCompile
+  testRuntime.extendsFrom nonprodRuntime
+
+  // Published jars that are used for server/schema compatibility tests.
+  // See <a href="../integration/README.md">the integration project</a>
+  // for details.
+  nomulus_test

  // Exclude non-canonical servlet-api jars. Our AppEngine deployment uses
  // javax.servlet:servlet-api:2.5
@@ -139,9 +164,8 @@ dependencies {

  // Custom-built objectify jar at commit ecd5165, included in Nomulus
  // release.
-  implementation files(
+  compile files(
      "${rootDir}/third_party/objectify/v4_1/objectify-4.1.3.jar")
-  testImplementation project(':third_party')

  testRuntime files(sourceSets.test.resources.srcDirs)

@@ -192,6 +216,7 @@ dependencies {
  testCompile deps['com.thoughtworks.qdox:qdox']
  compile deps['dnsjava:dnsjava']
  testCompile deps['io.github.classgraph:classgraph']
+  testRuntime deps['io.github.java-diff-utils:java-diff-utils']
  testCompile deps['javax.annotation:javax.annotation-api']
  testCompile deps['javax.annotation:jsr250-api']
  compile deps['javax.inject:javax.inject']
@@ -234,6 +259,7 @@ dependencies {
  compile deps['org.testcontainers:postgresql']
  testCompile deps['org.testcontainers:selenium']
  testCompile deps['org.testcontainers:testcontainers']
+  testCompile deps['pl.pragmatists:JUnitParams']
  compile deps['xerces:xmlParserAPIs']
  compile deps['xpp3:xpp3']
  // This dependency must come after javax.mail:mail as it would otherwise
@@ -243,7 +269,6 @@ dependencies {
  // Known issue: nebula-lint misses inherited dependency.
  compile project(':common')
  testCompile project(path: ':common', configuration: 'testing')
-  compile project(':third_party')
  compile project(':util')
  // Import NomulusPostreSql from ':db' for compile but exclude dependencies.
  compile project(path: ':db', configuration: 'compileApi')
@@ -660,10 +685,35 @@ task outcastTest(type: FilteringTest) {
  maxParallelForks 5
 }

+// Whitebox test verifying that RegistryTool can be instantiated. Note the
+// use of runtimeClasspath. This test emulates the logic in RegistryCli#run.
+// A to-do is added there to refactor.
+// TODO(weiminyu): Need a similar test for Registry server.
+task registryToolIntegrationTest {
+  dependsOn compileJava
+  doLast {
+    def classLoader =
+        new URLClassLoader(sourceSets.main.runtimeClasspath.collect {
+            it.toURI().toURL()
+        } as URL[])
+    def commandClasses =
+        (classLoader.loadClass('google.registry.tools.RegistryTool')
+            .getDeclaredField('COMMAND_MAP').get(null) as Map).values()
+
+    commandClasses.each {
+      try {
+        Constructor<?> c = ((Class<?>) it).getDeclaredConstructor()
+        c.setAccessible(true)
+        c.newInstance()
+      } catch (Throwable e) {
+        throw new RuntimeException("Failed to instantiate ${it}:\n ${e}")
+      }
+    }
+  }
+}
+
 // Dedicated test suite for schema-dependent tests.
 task sqlIntegrationTest(type: FilteringTest) {
-  systemProperties project.getProperties().subMap('sql_schema_resource_root')
-
  excludeTestCases = false
  tests = ['google/registry/schema/integration/SqlIntegrationTestSuite.*']
 }
@@ -682,41 +732,59 @@ task findGoldenImages(type: JavaExec) {
  args arguments
 }

-// To run the nomulus tool with these command line tokens:
+Optional<List<String>> getToolArgsList() {
+  // If "-PtoolArgs=..." is present in the command line, use it to set the args,
+  // otherwise use the default flag, which is "--args" to set the args.
+  def toolArgs = rootProject.findProperty("toolArgs")
+  if (toolArgs != null) {
+    def delimiter = '|'
+    toolArgs += delimiter
+    def argsList = []
+    def currArg = ''
+    for (def i = 0; i < toolArgs.length(); i++) {
+      def currChar = toolArgs[i]
+      if (currChar != delimiter) {
+        currArg += currChar
+      } else if (i != 0 && toolArgs[i - 1] == '\\') {
+        currArg = currArg.substring(0, currArg.length() - 1) + currChar
+      } else {
+        argsList.add(currArg)
+        currArg = ''
+      }
+    }
+    return Optional.of(argsList)
+  }
+  return Optional.empty()
+}
+
+
+// To run the nomulus tools with these command line tokens:
 // "--foo", "bar baz", "--qux=quz"
 //   gradle registryTool --args="--foo 'bar baz' --qux=quz"
 // or:
 //   gradle registryTool --PtoolArgs="--foo|bar baz|--qux=quz"
 // Note that the delimiting pipe can be backslash escaped if it is part of a
 // parameter.
-task registryTool(type: JavaExec) {
-  classpath = sourceSets.main.runtimeClasspath
-  main = 'google.registry.tools.RegistryTool'
+ext.createToolTask = {
+    taskName,
+    mainClass,
+    sourceSet = sourceSets.main ->
+  project.tasks.create(taskName, JavaExec) {
+    classpath = sourceSet.runtimeClasspath
+    main = mainClass

-  // If "-PtoolArgs=..." is present in the command line, use it to set the args,
-  // otherwise use the default flag, which is "--args" to set the args.
-  doFirst {
-    def toolArgs = rootProject.findProperty("toolArgs")
-    if (toolArgs != null) {
-      def delimiter = '|'
-      toolArgs += delimiter
-      def argsList = []
-      def currArg = ''
-      for (def i = 0; i < toolArgs.length(); i++) {
-        def currChar = toolArgs[i]
-        if (currChar != delimiter) {
-          currArg += currChar
-        } else if (i != 0 && toolArgs[i - 1] == '\\') {
-          currArg = currArg.substring(0, currArg.length() - 1) + currChar
-        } else {
-          argsList.add(currArg)
-          currArg = ''
-        }
+    doFirst {
+      getToolArgsList().ifPresent {
+        args it
      }
-      args = argsList
    }
  }
 }
+createToolTask('registryTool', 'google.registry.tools.RegistryTool')
+createToolTask(
+    'devTool',
+    'google.registry.tools.DevTool',
+    sourceSets.nonprod)

 task generateGoldenImages(type: FilteringTest) {
  tests = ["**/webdriver/*"]
@@ -779,15 +847,82 @@ test {
  // Don't run any tests from this task, all testing gets done in the
  // FilteringTest tasks.
  exclude "**"
-}.dependsOn(fragileTest, outcastTest, standardTest)
+}.dependsOn(fragileTest, outcastTest, standardTest, registryToolIntegrationTest)

 createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')
-project.nomulus.dependsOn project(':third_party').jar
+
+// A jar with classes and resources from main sourceSet, excluding internal
+// data. See comments on configurations.nomulus_test above for details.
+task nomulusFossJar (type: Jar) {
+  archiveBaseName = 'nomulus'
+  archiveClassifier = 'public'
+  from (project.sourceSets.main.output) {
+    exclude 'google/registry/config/files/**'
+  }
+  from (project.sourceSets.main.output) {
+    include 'google/registry/config/files/default-config.yaml'
+    include 'google/registry/config/files/nomulus-config-unittest.yaml'
+  }
+}
+
+// An UberJar of registry test classes, resources and all dependencies.
+// See comments on configurations.nomulus_test above for details.
+createUberJar(
+    'testUberJar',
+    'nomulus-tests',
+    '',
+    [project.configurations.testRuntimeClasspath],
+    [project.sourceSets.test.output],
+    [
+        // Exclude SQL schema, which is a test dependency.
+        'sql/flyway/**',
+        // ShadowJar includes java source files when used on
+        // sourceSets.test.output.
+        '**/*.java'
+    ])
+tasks.testUberJar {
+  archiveClassifier = 'alldeps'
+}
+
+artifacts {
+  nomulus_test nomulusFossJar
+  nomulus_test testUberJar
+}
+
+publishing {
+  repositories {
+    maven {
+      url project.publish_repo
+    }
+  }
+  publications {
+    nomulusTestsPublication(MavenPublication) {
+      groupId 'google.registry'
+      artifactId 'nomulus_test'
+      version project.nomulus_version
+      artifact nomulusFossJar
+      artifact testUberJar
+    }
+  }
+}

 task buildToolImage(dependsOn: nomulus, type: Exec) {
  commandLine 'docker', 'build', '-t', 'nomulus-tool', '.'
 }

+// Build the devtool jar.
+createUberJar(
+    'devtool',
+    'devtool',
+    'google.registry.tools.DevTool',
+    [ project.configurations.nonprodRuntimeClasspath ],
+    [ project.sourceSets.nonprod.output, sourceSets.main.output ],
+    [ '**/*.java' ])
+
+artifacts {
+  devtool devtool
+}
+
 task copyJsFilesForTestServer(dependsOn: assemble, type: Copy) {
  // Unfortunately the test server relies on having some compiled JS/CSS
  // in place, so copy it over here
@@ -802,5 +937,6 @@ task runTestServer(dependsOn: copyJsFilesForTestServer, type: JavaExec) {
  classpath = sourceSets.test.runtimeClasspath
 }

+project.build.dependsOn devtool
 project.build.dependsOn buildToolImage
 project.build.dependsOn ':stage'
--- a/core/gradle/dependency-locks/compile.lockfile
+++ b/core/gradle/dependency-locks/compile.lockfile
@@ -93,8 +93,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
--- a/core/gradle/dependency-locks/compileClasspath.lockfile
+++ b/core/gradle/dependency-locks/compileClasspath.lockfile
@@ -92,8 +92,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -163,7 +163,6 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -193,7 +192,6 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final
@@ -205,7 +203,6 @@ org.jetbrains:annotations:17.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
--- a/core/gradle/dependency-locks/default.lockfile
+++ b/core/gradle/dependency-locks/default.lockfile
@@ -104,8 +104,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
--- a/core/gradle/dependency-locks/deploy_jar.lockfile
+++ b/core/gradle/dependency-locks/deploy_jar.lockfile
@@ -0,0 +1,243 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.github.jnr:jffi:1.2.17
+com.github.jnr:jnr-a64asm:1.0.0
+com.github.jnr:jnr-constants:0.9.11
+com.github.jnr:jnr-enxio:0.19
+com.github.jnr:jnr-ffi:2.1.9
+com.github.jnr:jnr-posix:3.0.47
+com.github.jnr:jnr-unixsocket:0.21
+com.github.jnr:jnr-x86asm:1.0.2
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-sqladmin:v1beta4-rev56-1.23.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud.sql:jdbc-socket-factory-core:1.0.12
+com.google.cloud.sql:postgres-socket-factory:1.0.12
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:7.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:7.0
+org.ow2.asm:asm-util:7.0
+org.ow2.asm:asm:7.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/third_party/gradle/dependency-locks/apt.lockfile
+++ b/third_party/gradle/dependency-locks/apt.lockfile
--- a/third_party/gradle/dependency-locks/archives.lockfile
+++ b/third_party/gradle/dependency-locks/archives.lockfile
--- a/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
+++ b/core/gradle/dependency-locks/nonprodAnnotationProcessor.lockfile
--- a/third_party/gradle/dependency-locks/buildscript-classpath.lockfile
+++ b/third_party/gradle/dependency-locks/buildscript-classpath.lockfile
--- a/core/gradle/dependency-locks/nonprodCompile.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompile.lockfile
@@ -0,0 +1,234 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileClasspath.lockfile
@@ -0,0 +1,232 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodCompileOnly.lockfile
+++ b/core/gradle/dependency-locks/nonprodCompileOnly.lockfile
--- a/core/gradle/dependency-locks/nonprodRuntime.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntime.lockfile
@@ -0,0 +1,235 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/nonprodRuntimeClasspath.lockfile
@@ -0,0 +1,235 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+antlr:antlr:2.7.7
+aopalliance:aopalliance:1.0
+args4j:args4j:2.0.23
+cglib:cglib-nodep:2.2
+com.beust:jcommander:1.60
+com.fasterxml.jackson.core:jackson-annotations:2.9.10
+com.fasterxml.jackson.core:jackson-core:2.9.10
+com.fasterxml.jackson.core:jackson-databind:2.9.10
+com.fasterxml:classmate:1.3.4
+com.google.api-client:google-api-client-appengine:1.29.0
+com.google.api-client:google-api-client-jackson2:1.27.0
+com.google.api-client:google-api-client-java6:1.27.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
+com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.38.0
+com.google.api.grpc:grpc-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:grpc-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:grpc-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-cloud-bigquerystorage-v1beta1:0.44.0
+com.google.api.grpc:proto-google-cloud-bigtable-admin-v2:0.38.0
+com.google.api.grpc:proto-google-cloud-bigtable-v2:0.44.0
+com.google.api.grpc:proto-google-cloud-datastore-v1:0.44.0
+com.google.api.grpc:proto-google-cloud-pubsub-v1:1.43.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-database-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-admin-instance-v1:1.6.0
+com.google.api.grpc:proto-google-cloud-spanner-v1:1.6.0
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.api.grpc:proto-google-iam-v1:0.12.0
+com.google.api:api-common:1.7.0
+com.google.api:gax-grpc:1.38.0
+com.google.api:gax-httpjson:0.52.0
+com.google.api:gax:1.38.0
+com.google.apis:google-api-services-admin-directory:directory_v1-rev72-1.22.0
+com.google.apis:google-api-services-appengine:v1-rev101-1.25.0
+com.google.apis:google-api-services-bigquery:v2-rev20181104-1.27.0
+com.google.apis:google-api-services-clouddebugger:v2-rev20180801-1.27.0
+com.google.apis:google-api-services-cloudkms:v1-rev12-1.22.0
+com.google.apis:google-api-services-cloudresourcemanager:v1-rev20181015-1.27.0
+com.google.apis:google-api-services-dataflow:v1b3-rev20190607-1.27.0
+com.google.apis:google-api-services-dns:v2beta1-rev6-1.22.0
+com.google.apis:google-api-services-drive:v2-rev160-1.19.1
+com.google.apis:google-api-services-groupssettings:v1-rev60-1.22.0
+com.google.apis:google-api-services-monitoring:v3-rev426-1.23.0
+com.google.apis:google-api-services-pubsub:v1-rev20181105-1.27.0
+com.google.apis:google-api-services-sheets:v4-rev483-1.22.0
+com.google.apis:google-api-services-storage:v1-rev20181109-1.27.0
+com.google.appengine.tools:appengine-gcs-client:0.6
+com.google.appengine.tools:appengine-mapreduce:0.9
+com.google.appengine.tools:appengine-pipeline:0.2.13
+com.google.appengine:appengine-api-1.0-sdk:1.9.48
+com.google.appengine:appengine-remote-api:1.9.48
+com.google.appengine:appengine-testing:1.9.58
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
+com.google.auto.value:auto-value-annotations:1.6.3
+com.google.auto.value:auto-value:1.6.3
+com.google.cloud.bigdataoss:gcsio:1.9.16
+com.google.cloud.bigdataoss:util:1.9.16
+com.google.cloud.bigtable:bigtable-client-core:1.8.0
+com.google.cloud.datastore:datastore-v1-proto-client:1.6.0
+com.google.cloud:google-cloud-bigquerystorage:0.79.0-alpha
+com.google.cloud:google-cloud-bigtable-admin:0.73.0-alpha
+com.google.cloud:google-cloud-bigtable:0.73.0-alpha
+com.google.cloud:google-cloud-core-grpc:1.61.0
+com.google.cloud:google-cloud-core-http:1.55.0
+com.google.cloud:google-cloud-core:1.61.0
+com.google.cloud:google-cloud-spanner:1.6.0
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.5
+com.google.common.html.types:types:1.0.4
+com.google.dagger:dagger:2.21
+com.google.errorprone:error_prone_annotations:2.3.3
+com.google.flogger:flogger-system-backend:0.3.1
+com.google.flogger:flogger:0.3.1
+com.google.flogger:google-extensions:0.3.1
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:28.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.gwt:gwt-user:2.8.2
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client-jackson:1.20.0
+com.google.http-client:google-http-client-protobuf:1.20.0
+com.google.http-client:google-http-client:1.30.1
+com.google.inject.extensions:guice-multibindings:4.1.0
+com.google.inject:guice:4.1.0
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jsinterop:jsinterop-annotations:1.0.2
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
+com.google.oauth-client:google-oauth-client-java6:1.28.0
+com.google.oauth-client:google-oauth-client-jetty:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
+com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
+com.google.protobuf:protobuf-java-util:3.6.1
+com.google.protobuf:protobuf-java:3.6.1
+com.google.re2j:re2j:1.1
+com.google.template:soy:2018-03-14
+com.googlecode.charts4j:charts4j:1.3
+com.googlecode.json-simple:json-simple:1.1.1
+com.ibm.icu:icu4j:57.1
+com.jcraft:jsch:0.1.55
+com.kohlschutter.junixsocket:junixsocket-common:2.0.4
+com.kohlschutter.junixsocket:junixsocket-native-common:2.0.4
+com.squareup.okhttp:okhttp:2.5.0
+com.squareup.okio:okio:1.13.0
+com.sun.istack:istack-commons-runtime:3.0.7
+com.sun.xml.fastinfoset:FastInfoset:1.2.15
+com.thoughtworks.paranamer:paranamer:2.7
+com.zaxxer:HikariCP:3.2.0
+commons-codec:commons-codec:1.11
+commons-logging:commons-logging:1.2
+dnsjava:dnsjava:2.1.7
+io.dropwizard.metrics:metrics-core:3.1.2
+io.grpc:grpc-all:1.17.1
+io.grpc:grpc-alts:1.17.1
+io.grpc:grpc-auth:1.17.1
+io.grpc:grpc-context:1.19.0
+io.grpc:grpc-core:1.17.1
+io.grpc:grpc-grpclb:1.17.1
+io.grpc:grpc-netty-shaded:1.17.1
+io.grpc:grpc-netty:1.17.1
+io.grpc:grpc-okhttp:1.17.1
+io.grpc:grpc-protobuf-lite:1.17.1
+io.grpc:grpc-protobuf-nano:1.17.1
+io.grpc:grpc-protobuf:1.17.1
+io.grpc:grpc-stub:1.17.1
+io.grpc:grpc-testing:1.17.1
+io.netty:netty-buffer:4.1.30.Final
+io.netty:netty-codec-http2:4.1.30.Final
+io.netty:netty-codec-http:4.1.30.Final
+io.netty:netty-codec-socks:4.1.30.Final
+io.netty:netty-codec:4.1.30.Final
+io.netty:netty-common:4.1.30.Final
+io.netty:netty-handler-proxy:4.1.30.Final
+io.netty:netty-handler:4.1.30.Final
+io.netty:netty-resolver:4.1.30.Final
+io.netty:netty-tcnative-boringssl-static:2.0.17.Final
+io.netty:netty-transport:4.1.30.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
+io.opencensus:opencensus-contrib-grpc-util:0.17.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
+it.unimi.dsi:fastutil:6.5.16
+javax.activation:activation:1.1
+javax.activation:javax.activation-api:1.2.0
+javax.annotation:javax.annotation-api:1.3.2
+javax.annotation:jsr250-api:1.0
+javax.inject:javax.inject:1
+javax.jdo:jdo2-api:2.3-eb
+javax.mail:mail:1.4
+javax.persistence:javax.persistence-api:2.2
+javax.servlet:servlet-api:2.5
+javax.transaction:transaction-api:1.1
+javax.validation:validation-api:1.0.0.GA
+javax.xml.bind:jaxb-api:2.3.1
+jline:jline:1.0
+joda-time:joda-time:2.10.3
+junit:junit:4.12
+net.bytebuddy:byte-buddy:1.9.11
+net.java.dev.jna:jna-platform:5.3.1
+net.java.dev.jna:jna:5.3.1
+org.apache.avro:avro:1.8.2
+org.apache.beam:beam-model-job-management:2.16.0
+org.apache.beam:beam-model-pipeline:2.16.0
+org.apache.beam:beam-runners-core-construction-java:2.16.0
+org.apache.beam:beam-runners-google-cloud-dataflow-java:2.16.0
+org.apache.beam:beam-sdks-java-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core:2.16.0
+org.apache.beam:beam-sdks-java-extensions-protobuf:2.16.0
+org.apache.beam:beam-sdks-java-io-google-cloud-platform:2.16.0
+org.apache.beam:beam-vendor-bytebuddy-1_9_3:0.1
+org.apache.beam:beam-vendor-grpc-1_21_0:0.1
+org.apache.beam:beam-vendor-guava-26_0-jre:0.1
+org.apache.commons:commons-compress:1.19
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
+org.bouncycastle:bcpg-jdk15on:1.61
+org.bouncycastle:bcprov-jdk15on:1.61
+org.checkerframework:checker-qual:2.8.1
+org.codehaus.jackson:jackson-core-asl:1.9.13
+org.codehaus.jackson:jackson-mapper-asl:1.9.13
+org.codehaus.mojo:animal-sniffer-annotations:1.18
+org.dom4j:dom4j:2.1.1
+org.easymock:easymock:3.0
+org.glassfish.jaxb:jaxb-runtime:2.3.1
+org.glassfish.jaxb:txw2:2.3.1
+org.hamcrest:hamcrest-core:1.3
+org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
+org.hibernate:hibernate-core:5.4.4.Final
+org.hibernate:hibernate-hikaricp:5.4.4.Final
+org.javassist:javassist:3.24.0-GA
+org.jboss.logging:jboss-logging:3.3.2.Final
+org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:1.1.1.Final
+org.jboss:jandex:2.0.5.Final
+org.jetbrains:annotations:17.0.0
+org.joda:joda-money:1.0.1
+org.json:json:20160810
+org.jvnet.staxex:stax-ex:1.8
+org.mockito:mockito-core:1.9.5
+org.mortbay.jetty:jetty-util:6.1.26
+org.mortbay.jetty:jetty:6.1.26
+org.objenesis:objenesis:1.2
+org.ow2.asm:asm-analysis:6.0
+org.ow2.asm:asm-commons:6.0
+org.ow2.asm:asm-tree:6.0
+org.ow2.asm:asm-util:6.0
+org.ow2.asm:asm:6.0
+org.postgresql:postgresql:42.2.6
+org.rnorth.duct-tape:duct-tape:1.0.8
+org.rnorth.visible-assertions:visible-assertions:2.1.2
+org.rnorth:tcp-unix-socket-proxy:1.0.2
+org.scijava:native-lib-loader:2.0.2
+org.slf4j:slf4j-api:1.7.28
+org.testcontainers:database-commons:1.12.1
+org.testcontainers:jdbc:1.12.1
+org.testcontainers:postgresql:1.12.1
+org.testcontainers:testcontainers:1.12.1
+org.threeten:threetenbp:1.3.3
+org.tukaani:xz:1.8
+org.w3c.css:sac:1.3
+org.xerial.snappy:snappy-java:1.1.4
+org.yaml:snakeyaml:1.17
+xerces:xmlParserAPIs:2.6.2
+xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/runtime.lockfile
+++ b/core/gradle/dependency-locks/runtime.lockfile
@@ -93,8 +93,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -104,8 +104,8 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -176,7 +176,6 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-junit:junit:4.12
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
 net.java.dev.jna:jna:5.3.1
@@ -206,7 +205,6 @@ org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
-org.hamcrest:hamcrest-core:1.3
 org.hibernate.common:hibernate-commons-annotations:5.1.0.Final
 org.hibernate:hibernate-core:5.4.4.Final
 org.hibernate:hibernate-hikaricp:5.4.4.Final
@@ -218,7 +216,6 @@ org.jetbrains:annotations:17.0.0
 org.joda:joda-money:1.0.1
 org.json:json:20160810
 org.jvnet.staxex:stax-ex:1.8
-org.mockito:mockito-core:1.9.5
 org.mortbay.jetty:jetty-util:6.1.26
 org.mortbay.jetty:jetty:6.1.26
 org.objenesis:objenesis:1.2
--- a/core/gradle/dependency-locks/testCompile.lockfile
+++ b/core/gradle/dependency-locks/testCompile.lockfile
@@ -95,9 +95,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.6
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:contrib:1.0.7
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -174,7 +174,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
@@ -265,5 +265,6 @@ org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+pl.pragmatists:JUnitParams:1.1.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testCompileClasspath.lockfile
+++ b/core/gradle/dependency-locks/testCompileClasspath.lockfile
@@ -94,9 +94,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.6
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:contrib:1.0.7
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -172,7 +172,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
@@ -263,5 +263,6 @@ org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+pl.pragmatists:JUnitParams:1.1.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntime.lockfile
+++ b/core/gradle/dependency-locks/testRuntime.lockfile
@@ -106,9 +106,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.6
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:contrib:1.0.7
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -141,6 +141,7 @@ commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.github.classgraph:classgraph:4.8.52
+io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -185,7 +186,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
@@ -226,6 +227,7 @@ org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
@@ -278,5 +280,6 @@ org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+pl.pragmatists:JUnitParams:1.1.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/testRuntimeClasspath.lockfile
@@ -106,9 +106,9 @@ com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
 com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
-com.google.monitoring-client:contrib:1.0.6
-com.google.monitoring-client:metrics:1.0.6
-com.google.monitoring-client:stackdriver:1.0.6
+com.google.monitoring-client:contrib:1.0.7
+com.google.monitoring-client:metrics:1.0.7
+com.google.monitoring-client:stackdriver:1.0.7
 com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
@@ -141,6 +141,7 @@ commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.github.classgraph:classgraph:4.8.52
+io.github.java-diff-utils:java-diff-utils:4.0
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
@@ -185,7 +186,7 @@ javax.validation:validation-api:1.0.0.GA
 javax.xml.bind:jaxb-api:2.3.1
 jline:jline:1.0
 joda-time:joda-time:2.10.3
-junit:junit:4.12
+junit:junit:4.13
 net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.11
 net.java.dev.jna:jna-platform:5.3.1
@@ -226,6 +227,7 @@ org.codehaus.jackson:jackson-mapper-asl:1.9.13
 org.codehaus.mojo:animal-sniffer-annotations:1.18
 org.dom4j:dom4j:2.1.1
 org.easymock:easymock:3.0
+org.eclipse.jgit:org.eclipse.jgit:4.4.1.201607150455-r
 org.flywaydb:flyway-core:5.2.4
 org.glassfish.jaxb:jaxb-runtime:2.3.1
 org.glassfish.jaxb:txw2:2.3.1
@@ -278,5 +280,6 @@ org.tukaani:xz:1.8
 org.w3c.css:sac:1.3
 org.xerial.snappy:snappy-java:1.1.4
 org.yaml:snakeyaml:1.17
+pl.pragmatists:JUnitParams:1.1.1
 xerces:xmlParserAPIs:2.6.2
 xpp3:xpp3:1.1.4c
--- a/core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java
+++ b/core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java
@@ -47,7 +47,7 @@ import org.joda.time.DateTime;
    path = "/_dr/cron/commitLogCheckpoint",
    method = Action.Method.GET,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogCheckpointAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java
+++ b/core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java
@@ -65,7 +65,7 @@ import org.joda.time.Duration;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteOldCommitLogs",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class DeleteOldCommitLogsAction implements Runnable {

  private static final int NUM_MAP_SHARDS = 20;
--- a/core/src/main/java/google/registry/backup/ExportCommitLogDiffAction.java
+++ b/core/src/main/java/google/registry/backup/ExportCommitLogDiffAction.java
@@ -63,7 +63,7 @@ import org.joda.time.DateTime;
    path = ExportCommitLogDiffAction.PATH,
    method = Action.Method.POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ExportCommitLogDiffAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java
@@ -111,7 +111,7 @@ import org.joda.time.Duration;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteContactsAndHosts",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteContactsAndHostsAction implements Runnable {

  static final String KIND_CONTACT = getKind(ContactResource.class);
--- a/core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java
@@ -55,7 +55,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteLoadTestData",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteLoadTestDataAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/batch/DeleteProberDataAction.java
+++ b/core/src/main/java/google/registry/batch/DeleteProberDataAction.java
@@ -68,7 +68,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = "/_dr/task/deleteProberData",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class DeleteProberDataAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java
+++ b/core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java
@@ -75,7 +75,7 @@ import org.joda.time.DateTime;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/expandRecurringBillingEvents",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExpandRecurringBillingEventsAction implements Runnable {

  public static final String PARAM_CURSOR_TIME = "cursorTime";
--- a/core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java
+++ b/core/src/main/java/google/registry/batch/RefreshDnsOnHostRenameAction.java
@@ -75,7 +75,7 @@ import org.joda.time.Duration;
@Action(
    service = Action.Service.BACKEND,
    path = "/_dr/task/refreshDnsOnHostRename",
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class RefreshDnsOnHostRenameAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/config/RegistryConfig.java
+++ b/core/src/main/java/google/registry/config/RegistryConfig.java
@@ -917,6 +917,20 @@ public final class RegistryConfig {
      return parseEmailAddress(config.misc.spec11OutgoingEmailAddress);
    }

+    /**
+     * Returns the email addresses to which we will BCC Spec11 emails.
+     *
+     * @see google.registry.reporting.spec11.Spec11EmailUtils
+     */
+    @Provides
+    @Config("spec11BccEmailAddresses")
+    public static ImmutableList<InternetAddress> provideSpec11BccEmailAddresses(
+        RegistryConfigSettings config) {
+      return config.misc.spec11BccEmailAddresses.stream()
+          .map(RegistryConfig::parseEmailAddress)
+          .collect(toImmutableList());
+    }
+
    /**
     * Returns the name of the registry, for use in spec 11 emails.
     *
--- a/core/src/main/java/google/registry/config/RegistryConfigSettings.java
+++ b/core/src/main/java/google/registry/config/RegistryConfigSettings.java
@@ -193,6 +193,7 @@ public class RegistryConfigSettings {
    public String sheetExportId;
    public String alertRecipientEmailAddress;
    public String spec11OutgoingEmailAddress;
+    public List<String> spec11BccEmailAddresses;
    public int asyncDeleteDelaySeconds;
    public int transientFailureRetries;
  }
--- a/core/src/main/java/google/registry/config/files/default-config.yaml
+++ b/core/src/main/java/google/registry/config/files/default-config.yaml
@@ -389,6 +389,11 @@ misc:
  # to be a deliverable email address to handle replies from registrars as well.
  spec11OutgoingEmailAddress: abuse@example.com

+  # Addresses to which we will BCC all Spec11 email reports, in case one
+  # wishes to examine the output.
+  spec11BccEmailAddresses:
+    - abuse@example.com
+
  # How long to delay processing of asynchronous deletions. This should always
  # be longer than eppResourceCachingSeconds, to prevent deleted contacts or
  # hosts from being used on domains.
--- a/core/src/main/java/google/registry/cron/CommitLogFanoutAction.java
+++ b/core/src/main/java/google/registry/cron/CommitLogFanoutAction.java
@@ -33,7 +33,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/cron/commitLogFanout",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class CommitLogFanoutAction implements Runnable {

  public static final String BUCKET_PARAM = "bucket";
--- a/core/src/main/java/google/registry/cron/TldFanoutAction.java
+++ b/core/src/main/java/google/registry/cron/TldFanoutAction.java
@@ -87,7 +87,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/cron/fanout",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class TldFanoutAction implements Runnable {

  /** A set of control params to TldFanoutAction that aren't passed down to the executing action. */
--- a/core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java
+++ b/core/src/main/java/google/registry/dns/PublishDnsUpdatesAction.java
@@ -52,7 +52,7 @@ import org.joda.time.Duration;
    path = PublishDnsUpdatesAction.PATH,
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class PublishDnsUpdatesAction implements Runnable, Callable<Void> {

  public static final String PATH = "/_dr/task/publishDnsUpdates";
--- a/core/src/main/java/google/registry/dns/ReadDnsQueueAction.java
+++ b/core/src/main/java/google/registry/dns/ReadDnsQueueAction.java
@@ -80,7 +80,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = "/_dr/cron/readDnsQueue",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class ReadDnsQueueAction implements Runnable {

  private static final String PARAM_JITTER_SECONDS = "jitterSeconds";
--- a/core/src/main/java/google/registry/dns/RefreshDnsAction.java
+++ b/core/src/main/java/google/registry/dns/RefreshDnsAction.java
@@ -35,7 +35,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/dnsRefresh",
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class RefreshDnsAction implements Runnable {

  private final Clock clock;
--- a/core/src/main/java/google/registry/export/BackupDatastoreAction.java
+++ b/core/src/main/java/google/registry/export/BackupDatastoreAction.java
@@ -45,7 +45,7 @@ import javax.inject.Inject;
    path = BackupDatastoreAction.PATH,
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BackupDatastoreAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
+++ b/core/src/main/java/google/registry/export/BigqueryPollJobAction.java
@@ -51,7 +51,7 @@ import org.joda.time.Duration;
    path = BigqueryPollJobAction.PATH,
    method = {Action.Method.GET, Action.Method.POST},
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class BigqueryPollJobAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/CheckBackupAction.java
+++ b/core/src/main/java/google/registry/export/CheckBackupAction.java
@@ -59,7 +59,7 @@ import org.joda.time.format.PeriodFormat;
    path = CheckBackupAction.PATH,
    method = {POST, GET},
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class CheckBackupAction implements Runnable {

  /** Parameter names for passing parameters into this action. */
--- a/core/src/main/java/google/registry/export/ExportDomainListsAction.java
+++ b/core/src/main/java/google/registry/export/ExportDomainListsAction.java
@@ -65,7 +65,7 @@ import org.joda.time.DateTime;
    service = Action.Service.BACKEND,
    path = "/_dr/task/exportDomainLists",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportDomainListsAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/ExportPremiumTermsAction.java
+++ b/core/src/main/java/google/registry/export/ExportPremiumTermsAction.java
@@ -49,7 +49,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/exportPremiumTerms",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportPremiumTermsAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/ExportReservedTermsAction.java
+++ b/core/src/main/java/google/registry/export/ExportReservedTermsAction.java
@@ -37,7 +37,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/exportReservedTerms",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class ExportReservedTermsAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/SyncGroupMembersAction.java
+++ b/core/src/main/java/google/registry/export/SyncGroupMembersAction.java
@@ -56,7 +56,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = "/_dr/task/syncGroupMembers",
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class SyncGroupMembersAction implements Runnable {

  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
--- a/core/src/main/java/google/registry/export/UpdateSnapshotViewAction.java
+++ b/core/src/main/java/google/registry/export/UpdateSnapshotViewAction.java
@@ -39,7 +39,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = UpdateSnapshotViewAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UpdateSnapshotViewAction implements Runnable {

  /** Headers for passing parameters into the servlet. */
--- a/core/src/main/java/google/registry/export/UploadDatastoreBackupAction.java
+++ b/core/src/main/java/google/registry/export/UploadDatastoreBackupAction.java
@@ -52,7 +52,7 @@ import javax.inject.Inject;
    service = Action.Service.BACKEND,
    path = UploadDatastoreBackupAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class UploadDatastoreBackupAction implements Runnable {

  /** Parameter names for passing parameters into the servlet. */
--- a/core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java
+++ b/core/src/main/java/google/registry/export/sheet/SyncRegistrarsSheetAction.java
@@ -60,7 +60,7 @@ import org.joda.time.Duration;
    service = Action.Service.BACKEND,
    path = SyncRegistrarsSheetAction.PATH,
    method = POST,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public class SyncRegistrarsSheetAction implements Runnable {

  private enum Result {
--- a/core/src/main/java/google/registry/flows/FlowRunner.java
+++ b/core/src/main/java/google/registry/flows/FlowRunner.java
@@ -109,7 +109,9 @@ public class FlowRunner {
    }
  }

-  /** Exception for explicitly propagating an EppException out of the transactional {@code Work}. */
+  /**
+   * Exception for explicitly propagating an EppException out of the transactional {@code Supplier}.
+   */
  private static class EppRuntimeException extends RuntimeException {
    EppRuntimeException(EppException cause) {
      super(cause);
--- a/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/ResourceFlowUtils.java
@@ -42,6 +42,8 @@ import google.registry.model.EppResource.ForeignKeyedEppResource;
 import google.registry.model.EppResource.ResourceWithTransferData;
 import google.registry.model.contact.ContactResource;
 import google.registry.model.domain.DomainBase;
+import google.registry.model.domain.Period;
+import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.eppcommon.AuthInfo;
 import google.registry.model.eppcommon.StatusValue;
 import google.registry.model.index.ForeignKeyIndex;
@@ -247,6 +249,30 @@ public final class ResourceFlowUtils {
    }
  }

+  /**
+   * Computes the exDate for the domain at the given transfer approval time with an adjusted amount
+   * of transfer period years if the domain is in the auto renew grace period at the time of
+   * approval.
+   *
+   * @param domain is the domain already projected at approvalTime
+   */
+  public static DateTime computeExDateForApprovalTime(
+      DomainBase domain, DateTime approvalTime, Period period) {
+    boolean inAutoRenew = domain.getGracePeriodStatuses().contains(GracePeriodStatus.AUTO_RENEW);
+    // inAutoRenew is set to false if the period is zero because a zero-period transfer should not
+    // subsume an autorenew.
+    // https://www.icann.org/resources/unthemed-pages/appendix-07-2010-01-06-en section 3.1.2
+    // specifies that when a transfer occurs without a change to the expiration date, the losing
+    // registrar's account should still be charged for the autorenew.
+    if (period.getValue() == 0) {
+      inAutoRenew = false;
+    }
+    return DomainBase.extendRegistrationWithCap(
+        approvalTime,
+        domain.getRegistrationExpirationTime(),
+        period.getValue() - (inAutoRenew ? 1 : 0));
+  }
+
  /** Resource with this id does not exist. */
  public static class ResourceDoesNotExistException extends ObjectDoesNotExistException {
    public ResourceDoesNotExistException(Class<?> type, String targetId) {
--- a/core/src/main/java/google/registry/flows/domain/DomainTransferApproveFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainTransferApproveFlow.java
@@ -16,6 +16,7 @@ package google.registry.flows.domain;

 import static com.google.common.collect.Iterables.getOnlyElement;
 import static google.registry.flows.FlowUtils.validateClientIsLoggedIn;
+import static google.registry.flows.ResourceFlowUtils.computeExDateForApprovalTime;
 import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
 import static google.registry.flows.ResourceFlowUtils.verifyHasPendingTransfer;
 import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
@@ -26,7 +27,6 @@ import static google.registry.flows.domain.DomainFlowUtils.updateAutorenewRecurr
 import static google.registry.flows.domain.DomainTransferUtils.createGainingTransferPollMessage;
 import static google.registry.flows.domain.DomainTransferUtils.createTransferResponse;
 import static google.registry.model.ResourceTransferUtils.approvePendingTransfer;
-import static google.registry.model.domain.DomainBase.extendRegistrationWithCap;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.reporting.DomainTransactionRecord.TransactionReportField.TRANSFER_SUCCESSFUL;
 import static google.registry.model.transaction.TransactionManagerFactory.tm;
@@ -136,9 +136,7 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
    // increase the registration time, since the transfer subsumes the autorenew's extra year.
    GracePeriod autorenewGrace =
        getOnlyElement(existingDomain.getGracePeriodsOfType(GracePeriodStatus.AUTO_RENEW), null);
-    int extraYears = transferData.getTransferPeriod().getValue();
    if (autorenewGrace != null) {
-      extraYears = 0;
      // During a normal transfer, if the domain is in the auto-renew grace period, the auto-renew
      // billing event is cancelled and the gaining registrar is charged for the one year renewal.
      // But, if the superuser extension is used to request a transfer without an additional year
@@ -152,8 +150,8 @@ public final class DomainTransferApproveFlow implements TransactionalFlow {
    // Close the old autorenew event and poll message at the transfer time (aka now). This may end
    // up deleting the poll message.
    updateAutorenewRecurrenceEndTime(existingDomain, now);
-    DateTime newExpirationTime = extendRegistrationWithCap(
-        now, existingDomain.getRegistrationExpirationTime(), extraYears);
+    DateTime newExpirationTime =
+        computeExDateForApprovalTime(existingDomain, now, transferData.getTransferPeriod());
    // Create a new autorenew event starting at the expiration time.
    BillingEvent.Recurring autorenewEvent = new BillingEvent.Recurring.Builder()
        .setReason(Reason.RENEW)
--- a/core/src/main/java/google/registry/flows/domain/DomainTransferQueryFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainTransferQueryFlow.java
@@ -18,13 +18,13 @@ import static google.registry.flows.FlowUtils.validateClientIsLoggedIn;
 import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
 import static google.registry.flows.ResourceFlowUtils.verifyOptionalAuthInfo;
 import static google.registry.flows.domain.DomainTransferUtils.createTransferResponse;
-import static google.registry.model.domain.DomainBase.extendRegistrationWithCap;

 import google.registry.flows.EppException;
 import google.registry.flows.ExtensionManager;
 import google.registry.flows.Flow;
 import google.registry.flows.FlowModule.ClientId;
 import google.registry.flows.FlowModule.TargetId;
+import google.registry.flows.ResourceFlowUtils;
 import google.registry.flows.annotations.ReportingSpec;
 import google.registry.flows.exceptions.NoTransferHistoryToQueryException;
 import google.registry.flows.exceptions.NotAuthorizedToViewTransferException;
@@ -86,10 +86,12 @@ public final class DomainTransferQueryFlow implements Flow {
      throw new NotAuthorizedToViewTransferException();
    }
    DateTime newExpirationTime = null;
-    if (transferData.getTransferStatus().isApproved()
-        || transferData.getTransferStatus().equals(TransferStatus.PENDING)) {
-      // TODO(b/25084229): fix exDate computation logic.
-      newExpirationTime = extendRegistrationWithCap(now, domain.getRegistrationExpirationTime(), 1);
+    if (transferData.getTransferStatus().isApproved()) {
+      newExpirationTime = transferData.getTransferredRegistrationExpirationTime();
+    } else if (transferData.getTransferStatus().equals(TransferStatus.PENDING)) {
+      newExpirationTime =
+          ResourceFlowUtils.computeExDateForApprovalTime(
+              domain, now, domain.getTransferData().getTransferPeriod());
    }
    return responseBuilder
        .setResData(createTransferResponse(targetId, transferData, newExpirationTime))
--- a/core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java
+++ b/core/src/main/java/google/registry/flows/domain/DomainTransferRequestFlow.java
@@ -15,6 +15,7 @@
 package google.registry.flows.domain;

 import static google.registry.flows.FlowUtils.validateClientIsLoggedIn;
+import static google.registry.flows.ResourceFlowUtils.computeExDateForApprovalTime;
 import static google.registry.flows.ResourceFlowUtils.loadAndVerifyExistence;
 import static google.registry.flows.ResourceFlowUtils.verifyAuthInfo;
 import static google.registry.flows.ResourceFlowUtils.verifyAuthInfoPresentForResourceTransfer;
@@ -29,7 +30,6 @@ import static google.registry.flows.domain.DomainTransferUtils.createLosingTrans
 import static google.registry.flows.domain.DomainTransferUtils.createPendingTransferData;
 import static google.registry.flows.domain.DomainTransferUtils.createTransferResponse;
 import static google.registry.flows.domain.DomainTransferUtils.createTransferServerApproveEntities;
-import static google.registry.model.domain.DomainBase.extendRegistrationWithCap;
 import static google.registry.model.eppoutput.Result.Code.SUCCESS_WITH_ACTION_PENDING;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.transaction.TransactionManagerFactory.tm;
@@ -56,7 +56,6 @@ import google.registry.model.domain.Period;
 import google.registry.model.domain.fee.FeeTransferCommandExtension;
 import google.registry.model.domain.fee.FeeTransformResponseExtension;
 import google.registry.model.domain.metadata.MetadataExtension;
-import google.registry.model.domain.rgp.GracePeriodStatus;
 import google.registry.model.domain.superuser.DomainTransferRequestSuperuserExtension;
 import google.registry.model.eppcommon.AuthInfo;
 import google.registry.model.eppcommon.StatusValue;
@@ -183,18 +182,10 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
    //
    // See b/19430703#comment17 and https://www.icann.org/news/advisory-2002-06-06-en for the
    // policy documentation for transfers subsuming autorenews within the autorenew grace period.
-    int extraYears = period.getValue();
-    DomainBase domainAtTransferTime =
-        existingDomain.cloneProjectedAtTime(automaticTransferTime);
-    if (!domainAtTransferTime.getGracePeriodsOfType(GracePeriodStatus.AUTO_RENEW).isEmpty()) {
-      extraYears = 0;
-    }
+    DomainBase domainAtTransferTime = existingDomain.cloneProjectedAtTime(automaticTransferTime);
    // The new expiration time if there is a server approval.
    DateTime serverApproveNewExpirationTime =
-        extendRegistrationWithCap(
-            automaticTransferTime,
-            domainAtTransferTime.getRegistrationExpirationTime(),
-            extraYears);
+        computeExDateForApprovalTime(domainAtTransferTime, automaticTransferTime, period);
    // Create speculative entities in anticipation of an automatic server approval.
    ImmutableSet<TransferServerApproveEntity> serverApproveEntities =
        createTransferServerApproveEntities(
@@ -337,10 +328,8 @@ public final class DomainTransferRequestFlow implements TransactionalFlow {
    // If the registration were approved this instant, this is what the new expiration would be,
    // because we cap at 10 years from the moment of approval. This is different than the server
    // approval new expiration time, which is capped at 10 years from the server approve time.
-    DateTime approveNowExtendedRegistrationTime = extendRegistrationWithCap(
-        now,
-        existingDomain.getRegistrationExpirationTime(),
-        period.getValue());
+    DateTime approveNowExtendedRegistrationTime =
+        computeExDateForApprovalTime(existingDomain, now, period);
    return createTransferResponse(
        targetId, newDomain.getTransferData(), approveNowExtendedRegistrationTime);
  }
--- a/core/src/main/java/google/registry/model/CacheUtils.java
+++ b/core/src/main/java/google/registry/model/CacheUtils.java
@@ -32,7 +32,15 @@ public class CacheUtils {
   * lists downloaded from the TMCH get updated in Datastore and the caches need to be refreshed.)
   */
  public static <T> Supplier<T> memoizeWithShortExpiration(Supplier<T> original) {
-    Duration expiration = getSingletonCacheRefreshDuration();
+    return tryMemoizeWithExpiration(getSingletonCacheRefreshDuration(), original);
+  }
+
+  /**
+   * Memoize a supplier with the given expiration. If the expiration is zero(likely happens in a
+   * unit test), it returns the original supplier.
+   */
+  public static <T> Supplier<T> tryMemoizeWithExpiration(
+      Duration expiration, Supplier<T> original) {
    return expiration.isEqual(ZERO)
        ? original
        : memoizeWithExpiration(original, expiration.getMillis(), MILLISECONDS);
--- a/core/src/main/java/google/registry/model/ResourceTransferUtils.java
+++ b/core/src/main/java/google/registry/model/ResourceTransferUtils.java
@@ -17,7 +17,6 @@ package google.registry.model;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
-import static google.registry.model.domain.DomainBase.extendRegistrationWithCap;
 import static google.registry.model.ofy.ObjectifyService.ofy;

 import com.google.common.collect.ImmutableList;
@@ -53,24 +52,22 @@ public final class ResourceTransferUtils {
      TransferStatus.PENDING, TransferStatus.CLIENT_APPROVED, TransferStatus.SERVER_APPROVED);

  /**
-   * Create a transfer response using the id and type of this resource and the specified
-   * {@link TransferData}.
+   * Create a transfer response using the id and type of this resource and the specified {@link
+   * TransferData}.
   */
  public static TransferResponse createTransferResponse(
-      EppResource eppResource, TransferData transferData, DateTime now) {
+      EppResource eppResource, TransferData transferData) {
    assertIsContactOrDomain(eppResource);
    TransferResponse.Builder<? extends TransferResponse, ?> builder;
    if (eppResource instanceof ContactResource) {
      builder = new ContactTransferResponse.Builder().setContactId(eppResource.getForeignKey());
    } else {
-      DomainBase domain = (DomainBase) eppResource;
      builder =
          new DomainTransferResponse.Builder()
              .setFullyQualifiedDomainName(eppResource.getForeignKey())
-              // TODO(b/25084229): fix exDate computation logic.
              .setExtendedRegistrationExpirationTime(
                  ADD_EXDATE_STATUSES.contains(transferData.getTransferStatus())
-                      ? extendRegistrationWithCap(now, domain.getRegistrationExpirationTime(), 1)
+                      ? transferData.getTransferredRegistrationExpirationTime()
                      : null);
    }
    builder.setGainingClientId(transferData.getGainingClientId())
@@ -118,16 +115,20 @@ public final class ResourceTransferUtils {
    if (resource.getStatusValues().contains(StatusValue.PENDING_TRANSFER)) {
      TransferData oldTransferData = resource.getTransferData();
      ofy().delete().keys(oldTransferData.getServerApproveEntities());
-      ofy().save().entity(new PollMessage.OneTime.Builder()
-          .setClientId(oldTransferData.getGainingClientId())
-          .setEventTime(now)
-          .setMsg(TransferStatus.SERVER_CANCELLED.getMessage())
-          .setResponseData(ImmutableList.of(
-              createTransferResponse(newResource, newResource.getTransferData(), now),
-              createPendingTransferNotificationResponse(
-                  resource, oldTransferData.getTransferRequestTrid(), false, now)))
-          .setParent(historyEntry)
-          .build());
+      ofy()
+          .save()
+          .entity(
+              new PollMessage.OneTime.Builder()
+                  .setClientId(oldTransferData.getGainingClientId())
+                  .setEventTime(now)
+                  .setMsg(TransferStatus.SERVER_CANCELLED.getMessage())
+                  .setResponseData(
+                      ImmutableList.of(
+                          createTransferResponse(newResource, newResource.getTransferData()),
+                          createPendingTransferNotificationResponse(
+                              resource, oldTransferData.getTransferRequestTrid(), false, now)))
+                  .setParent(historyEntry)
+                  .build());
    }
  }

--- a/core/src/main/java/google/registry/model/common/Cursor.java
+++ b/core/src/main/java/google/registry/model/common/Cursor.java
@@ -87,7 +87,9 @@ public class Cursor extends ImmutableObject {
    /** Cursor for tracking monthly uploads of ICANN activity reports. */
    ICANN_UPLOAD_ACTIVITY(Registry.class),

-    /** Cursor for tracking monthly upload of MANIFEST.txt to ICANN. */
+    // TODO(sarahbot) Delete this cursor once all data in the database that refers to it is removed.
+    /** Cursor for tracking monthly uploads of MANIFEST.txt to ICANN. No longer used. */
+    @Deprecated
    ICANN_UPLOAD_MANIFEST(EntityGroupRoot.class);

    /** See the definition of scope on {@link #getScopeClass}. */
--- a/core/src/main/java/google/registry/model/domain/DomainBase.java
+++ b/core/src/main/java/google/registry/model/domain/DomainBase.java
@@ -45,6 +45,7 @@ import com.googlecode.objectify.annotation.Entity;
 import com.googlecode.objectify.annotation.IgnoreSave;
 import com.googlecode.objectify.annotation.Index;
 import com.googlecode.objectify.condition.IfNull;
+import google.registry.flows.ResourceFlowUtils;
 import google.registry.model.EppResource;
 import google.registry.model.EppResource.ForeignKeyedEppResource;
 import google.registry.model.EppResource.ResourceWithTransferData;
@@ -377,28 +378,31 @@ public class DomainBase extends EppResource
      // exclusive of their ending), and we can just proceed with the transfer.
      DomainBase domainAtTransferTime =
          cloneProjectedAtTime(transferExpirationTime.minusMillis(1));
+
+      DateTime expirationDate = transferData.getTransferredRegistrationExpirationTime();
+      if (expirationDate == null) {
+        // Extend the registration by the correct number of years from the expiration time
+        // that was current on the domain right before the transfer, capped at 10 years from
+        // the moment of the transfer.
+        expirationDate =
+            ResourceFlowUtils.computeExDateForApprovalTime(
+                domainAtTransferTime, transferExpirationTime, transferData.getTransferPeriod());
+      }
      // If we are within an autorenew grace period, the transfer will subsume the autorenew. There
      // will already be a cancellation written in advance by the transfer request flow, so we don't
      // need to worry about billing, but we do need to cancel out the expiration time increase.
      // The transfer period saved in the transfer data will be one year, unless the superuser
      // extension set the transfer period to zero.
-      int extraYears = transferData.getTransferPeriod().getValue();
-      if (domainAtTransferTime.getGracePeriodStatuses().contains(GracePeriodStatus.AUTO_RENEW)) {
-        extraYears = 0;
-      }
      // Set the expiration, autorenew events, and grace period for the transfer. (Transfer ends
      // all other graces).
-      Builder builder = domainAtTransferTime.asBuilder()
-          // Extend the registration by the correct number of years from the expiration time that
-          // was current on the domain right before the transfer, capped at 10 years from the
-          // moment of the transfer.
-          .setRegistrationExpirationTime(extendRegistrationWithCap(
-              transferExpirationTime,
-              domainAtTransferTime.getRegistrationExpirationTime(),
-              extraYears))
-          // Set the speculatively-written new autorenew events as the domain's autorenew events.
-          .setAutorenewBillingEvent(transferData.getServerApproveAutorenewEvent())
-          .setAutorenewPollMessage(transferData.getServerApproveAutorenewPollMessage());
+      Builder builder =
+          domainAtTransferTime
+              .asBuilder()
+              .setRegistrationExpirationTime(expirationDate)
+              // Set the speculatively-written new autorenew events as the domain's autorenew
+              // events.
+              .setAutorenewBillingEvent(transferData.getServerApproveAutorenewEvent())
+              .setAutorenewPollMessage(transferData.getServerApproveAutorenewPollMessage());
      if (transferData.getTransferPeriod().getValue() == 1) {
        // Set the grace period using a key to the prescheduled transfer billing event.  Not using
        // GracePeriod.forBillingEvent() here in order to avoid the actual Datastore fetch.
--- a/core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java
+++ b/core/src/main/java/google/registry/model/ofy/CommitLoggedWork.java
@@ -30,28 +30,28 @@ import com.google.common.collect.ImmutableSet;
 import com.googlecode.objectify.Key;
 import google.registry.model.BackupGroupRoot;
 import google.registry.model.ImmutableObject;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;

-/** Wrapper for {@link Work} that associates a time with each attempt. */
+/** Wrapper for {@link Supplier} that associates a time with each attempt. */
 class CommitLoggedWork<R> implements Runnable {

-  private final Work<R> work;
+  private final Supplier<R> work;
  private final Clock clock;

  /**
   * Temporary place to store the result of a non-void work.
   *
   * <p>We don't want to return the result directly because we are going to try to recover from a
-   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify
-   * when it tries to commit the transaction. When an exception is thrown the return value would be
-   * lost, but sometimes we will be able to determine that we actually succeeded despite the
-   * timeout, and we'll want to get the result.
+   * {@link com.google.appengine.api.datastore.DatastoreTimeoutException} deep inside Objectify when
+   * it tries to commit the transaction. When an exception is thrown the return value would be lost,
+   * but sometimes we will be able to determine that we actually succeeded despite the timeout, and
+   * we'll want to get the result.
   */
  private R result;

@@ -76,7 +76,7 @@ class CommitLoggedWork<R> implements Runnable {
  /** Lifecycle marker to track whether {@link #run} has been called. */
  private boolean runCalled;

-  CommitLoggedWork(Work<R> work, Clock clock) {
+  CommitLoggedWork(Supplier<R> work, Clock clock) {
    this.work = work;
    this.clock = clock;
  }
@@ -111,7 +111,7 @@ class CommitLoggedWork<R> implements Runnable {
    // Set the time to be used for "now" within the transaction.
    try {
      Ofy.TRANSACTION_INFO.set(createNewTransactionInfo());
-      result = work.run();
+      result = work.get();
      saveCommitLog(Ofy.TRANSACTION_INFO.get());
    } finally {
      Ofy.TRANSACTION_INFO.set(previous);
--- a/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
+++ b/core/src/main/java/google/registry/model/ofy/DatastoreTransactionManager.java
@@ -17,6 +17,7 @@ package google.registry.model.ofy;
 import static google.registry.model.ofy.ObjectifyService.ofy;

 import google.registry.model.transaction.TransactionManager;
+import java.util.function.Supplier;
 import org.joda.time.DateTime;

 /** Datastore implementation of {@link TransactionManager}. */
@@ -44,7 +45,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
    return getOfy().transact(work);
  }

@@ -54,7 +55,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
    return getOfy().transactNew(work);
  }

@@ -64,7 +65,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <R> R transactNewReadOnly(Work<R> work) {
+  public <R> R transactNewReadOnly(Supplier<R> work) {
    return getOfy().transactNewReadOnly(work);
  }

@@ -74,7 +75,7 @@ public class DatastoreTransactionManager implements TransactionManager {
  }

  @Override
-  public <R> R doTransactionless(Work<R> work) {
+  public <R> R doTransactionless(Supplier<R> work) {
    return getOfy().doTransactionless(work);
  }

--- a/core/src/main/java/google/registry/model/ofy/Ofy.java
+++ b/core/src/main/java/google/registry/model/ofy/Ofy.java
@@ -38,7 +38,6 @@ import com.googlecode.objectify.cmd.Saver;
 import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.VirtualEntity;
 import google.registry.model.ofy.ReadOnlyWork.KillTransactionException;
-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
 import google.registry.util.NonFinalForTesting;
 import google.registry.util.Sleeper;
@@ -46,6 +45,7 @@ import google.registry.util.SystemClock;
 import google.registry.util.SystemSleeper;
 import java.lang.annotation.Annotation;
 import java.util.Objects;
+import java.util.function.Supplier;
 import javax.inject.Inject;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
@@ -194,9 +194,9 @@ public class Ofy {
  }

  /** Execute a transaction. */
-  <R> R transact(Work<R> work) {
+  <R> R transact(Supplier<R> work) {
    // If we are already in a transaction, don't wrap in a CommitLoggedWork.
-    return inTransaction() ? work.run() : transactNew(work);
+    return inTransaction() ? work.get() : transactNew(work);
  }

  /**
@@ -214,7 +214,7 @@ public class Ofy {
  }

  /** Pause the current transaction (if any) and complete this one before returning to it. */
-  <R> R transactNew(Work<R> work) {
+  <R> R transactNew(Supplier<R> work) {
    // Wrap the Work in a CommitLoggedWork so that we can give transactions a frozen view of time
    // and maintain commit logs for them.
    return transactCommitLoggedWork(new CommitLoggedWork<>(work, getClock()));
@@ -298,7 +298,7 @@ public class Ofy {
  }

  /** A read-only transaction is useful to get strongly consistent reads at a shared timestamp. */
-  <R> R transactNewReadOnly(Work<R> work) {
+  <R> R transactNewReadOnly(Supplier<R> work) {
    ReadOnlyWork<R> readOnlyWork = new ReadOnlyWork<>(work, getClock());
    try {
      ofy().transactNew(() -> {
@@ -324,11 +324,11 @@ public class Ofy {
  }

  /** Execute some work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work) {
+  <R> R doTransactionless(Supplier<R> work) {
    try {
      com.googlecode.objectify.ObjectifyService.push(
          com.googlecode.objectify.ObjectifyService.ofy().transactionless());
-      return work.run();
+      return work.get();
    } finally {
      com.googlecode.objectify.ObjectifyService.pop();
    }
@@ -342,11 +342,11 @@ public class Ofy {
   * Note that unlike a transaction's fresh session cache, the contents of this cache will be
   * discarded once the work completes, rather than being propagated into the enclosing session.
   */
-  public <R> R doWithFreshSessionCache(Work<R> work) {
+  public <R> R doWithFreshSessionCache(Supplier<R> work) {
    try {
      com.googlecode.objectify.ObjectifyService.push(
          com.googlecode.objectify.ObjectifyService.factory().begin());
-      return work.run();
+      return work.get();
    } finally {
      com.googlecode.objectify.ObjectifyService.pop();
    }
--- a/core/src/main/java/google/registry/model/ofy/ReadOnlyWork.java
+++ b/core/src/main/java/google/registry/model/ofy/ReadOnlyWork.java
@@ -14,13 +14,13 @@

 package google.registry.model.ofy;

-import google.registry.model.transaction.TransactionManager.Work;
 import google.registry.util.Clock;
+import java.util.function.Supplier;

-/** Wrapper for {@link Work} that disallows mutations and fails the transaction at the end. */
+/** Wrapper for {@link Supplier} that disallows mutations and fails the transaction at the end. */
 class ReadOnlyWork<R> extends CommitLoggedWork<R> {

-  ReadOnlyWork(Work<R> work, Clock clock) {
+  ReadOnlyWork(Supplier<R> work, Clock clock) {
    super(work, clock);
  }

--- a/core/src/main/java/google/registry/model/registry/Registry.java
+++ b/core/src/main/java/google/registry/model/registry/Registry.java
@@ -791,6 +791,12 @@ public class Registry extends ImmutableObject implements Buildable {
      return this;
    }

+    @VisibleForTesting
+    public Builder setPremiumListKey(@Nullable Key<PremiumList> premiumList) {
+      getInstance().premiumList = premiumList;
+      return this;
+    }
+
    public Builder setRestoreBillingCost(Money amount) {
      checkArgument(amount.isPositiveOrZero(), "restoreBillingCost cannot be negative");
      getInstance().restoreBillingCost = amount;
--- a/core/src/main/java/google/registry/model/registry/RegistryLockDao.java
+++ b/core/src/main/java/google/registry/model/registry/RegistryLockDao.java
@@ -49,7 +49,7 @@ public final class RegistryLockDao {
  }

  /** Returns all lock objects that this registrar has created. */
-  public static ImmutableList<RegistryLock> getByRegistrarId(String registrarId) {
+  public static ImmutableList<RegistryLock> getLockedDomainsByRegistrarId(String registrarId) {
    return jpaTm()
        .transact(
            () ->
@@ -58,7 +58,9 @@ public final class RegistryLockDao {
                        .getEntityManager()
                        .createQuery(
                            "SELECT lock FROM RegistryLock lock WHERE"
-                                + " lock.registrarId = :registrarId",
+                                + " lock.registrarId = :registrarId "
+                                + "AND lock.lockCompletionTimestamp IS NOT NULL "
+                                + "AND lock.unlockCompletionTimestamp IS NULL",
                            RegistryLock.class)
                        .setParameter("registrarId", registrarId)
                        .getResultList()));
--- a/core/src/main/java/google/registry/model/registry/label/BaseDomainLabelList.java
+++ b/core/src/main/java/google/registry/model/registry/label/BaseDomainLabelList.java
@@ -121,7 +121,7 @@ public abstract class BaseDomainLabelList<T extends Comparable<?>, R extends Dom
   * (sans comment) and the comment (in that order). If the line was blank or empty, then this
   * method returns an empty list.
   */
-  protected static List<String> splitOnComment(String line) {
+  public static List<String> splitOnComment(String line) {
    String comment = "";
    int index = line.indexOf('#');
    if (index != -1) {
--- a/core/src/main/java/google/registry/model/registry/label/PremiumListUtils.java
+++ b/core/src/main/java/google/registry/model/registry/label/PremiumListUtils.java
@@ -36,11 +36,13 @@ import com.google.common.cache.CacheLoader.InvalidCacheLoadException;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Streams;
+import com.google.common.flogger.FluentLogger;
 import com.googlecode.objectify.Key;
 import google.registry.model.registry.Registry;
 import google.registry.model.registry.label.DomainLabelMetrics.PremiumListCheckOutcome;
 import google.registry.model.registry.label.PremiumList.PremiumListEntry;
 import google.registry.model.registry.label.PremiumList.PremiumListRevision;
+import google.registry.schema.tld.PremiumListDao;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
@@ -52,7 +54,9 @@ import org.joda.time.DateTime;
 public final class PremiumListUtils {

  /** The number of premium list entry entities that are created and deleted per batch. */
-  static final int TRANSACTION_BATCH_SIZE = 200;
+  private static final int TRANSACTION_BATCH_SIZE = 200;
+
+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();

  /** Value type class used by {@link #checkStatus} to return the results of a premiumness check. */
  @AutoValue
@@ -97,6 +101,19 @@ public final class PremiumListUtils {
        listName,
        checkResults.checkOutcome(),
        DateTime.now(UTC).getMillis() - startTime.getMillis());
+
+    // Also load the value from Cloud SQL, compare the two results, and log if different.
+    try {
+      Optional<Money> priceFromSql = PremiumListDao.getPremiumPrice(label, registry);
+      if (!priceFromSql.equals(checkResults.premiumPrice())) {
+        logger.atWarning().log(
+            "Unequal prices for domain %s.%s from Datastore (%s) and Cloud SQL (%s).",
+            label, registry.getTldStr(), checkResults.premiumPrice(), priceFromSql);
+      }
+    } catch (Throwable t) {
+      logger.atSevere().withCause(t).log(
+          "Error loading price of domain %s.%s from Cloud SQL.", label, registry.getTldStr());
+    }
    return checkResults.premiumPrice();
  }

--- a/core/src/main/java/google/registry/model/registry/label/ReservedList.java
+++ b/core/src/main/java/google/registry/model/registry/label/ReservedList.java
@@ -16,6 +16,7 @@ package google.registry.model.registry.label;

 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
 import static google.registry.config.RegistryConfig.getDomainLabelListCacheDuration;
 import static google.registry.model.common.EntityGroupRoot.getCrossTldKey;
@@ -31,6 +32,10 @@ import com.google.common.cache.CacheLoader;
 import com.google.common.cache.LoadingCache;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.MapDifference;
+import com.google.common.collect.MapDifference.ValueDifference;
+import com.google.common.collect.Maps;
+import com.google.common.flogger.FluentLogger;
 import com.google.common.util.concurrent.UncheckedExecutionException;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.Embed;
@@ -40,6 +45,8 @@ import com.googlecode.objectify.mapper.Mapper;
 import google.registry.model.Buildable;
 import google.registry.model.registry.Registry;
 import google.registry.model.registry.label.DomainLabelMetrics.MetricsReservedListMatch;
+import google.registry.schema.tld.ReservedList.ReservedEntry;
+import google.registry.schema.tld.ReservedListDao;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -54,6 +61,8 @@ import org.joda.time.DateTime;
 public final class ReservedList
    extends BaseDomainLabelList<ReservationType, ReservedList.ReservedListEntry> {

+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
  @Mapify(ReservedListEntry.LabelMapper.class)
  Map<String, ReservedListEntry> reservedListMap;

@@ -222,13 +231,67 @@ public final class ReservedList
              new CacheLoader<String, ReservedList>() {
                @Override
                public ReservedList load(String listName) {
-                  return ofy()
-                      .load()
-                      .type(ReservedList.class)
-                      .parent(getCrossTldKey())
-                      .id(listName)
-                      .now();
-                }});
+                  ReservedList datastoreList =
+                      ofy()
+                          .load()
+                          .type(ReservedList.class)
+                          .parent(getCrossTldKey())
+                          .id(listName)
+                          .now();
+                  // Also load the list from Cloud SQL, compare the two lists, and log if different.
+                  try {
+                    loadAndCompareCloudSqlList(datastoreList);
+                  } catch (Throwable t) {
+                    logger.atSevere().withCause(t).log("Error comparing reserved lists.");
+                  }
+                  return datastoreList;
+                }
+              });
+
+  private static final void loadAndCompareCloudSqlList(ReservedList datastoreList) {
+    Optional<google.registry.schema.tld.ReservedList> maybeCloudSqlList =
+        ReservedListDao.getLatestRevision(datastoreList.getName());
+    if (maybeCloudSqlList.isPresent()) {
+      Map<String, ReservedEntry> datastoreLabelsToReservations =
+          datastoreList.reservedListMap.entrySet().parallelStream()
+              .collect(
+                  toImmutableMap(
+                      entry -> entry.getKey(),
+                      entry ->
+                          ReservedEntry.create(
+                              entry.getValue().reservationType, entry.getValue().comment)));
+
+      google.registry.schema.tld.ReservedList cloudSqlList = maybeCloudSqlList.get();
+      MapDifference<String, ReservedEntry> diff =
+          Maps.difference(datastoreLabelsToReservations, cloudSqlList.getLabelsToReservations());
+      if (!diff.areEqual()) {
+        if (diff.entriesDiffering().size() > 10) {
+          logger.atWarning().log(
+              String.format(
+                  "Unequal reserved lists detected, Cloud SQL list with revision"
+                      + " id %d has %d different records than the current"
+                      + " Datastore list.",
+                  cloudSqlList.getRevisionId(), diff.entriesDiffering().size()));
+        } else {
+          StringBuilder diffMessage = new StringBuilder("Unequal reserved lists detected:\n");
+          diff.entriesDiffering().entrySet().stream()
+              .forEach(
+                  entry -> {
+                    String label = entry.getKey();
+                    ValueDifference<ReservedEntry> valueDiff = entry.getValue();
+                    diffMessage.append(
+                        String.format(
+                            "Domain label %s has entry %s in Datastore and entry"
+                                + " %s in Cloud SQL.\n",
+                            label, valueDiff.leftValue(), valueDiff.rightValue()));
+                  });
+          logger.atWarning().log(diffMessage.toString());
+        }
+      }
+    } else {
+      logger.atWarning().log("Reserved list in Cloud SQL is empty.");
+    }
+  }

  /**
   * Gets the {@link ReservationType} of a label in a single ReservedList, or returns an absent
--- a/core/src/main/java/google/registry/model/tmch/ClaimsListShard.java
+++ b/core/src/main/java/google/registry/model/tmch/ClaimsListShard.java
@@ -27,6 +27,10 @@ import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.MapDifference;
+import com.google.common.collect.MapDifference.ValueDifference;
+import com.google.common.collect.Maps;
+import com.google.common.flogger.FluentLogger;
 import com.google.common.util.concurrent.UncheckedExecutionException;
 import com.googlecode.objectify.Key;
 import com.googlecode.objectify.annotation.EmbedMap;
@@ -40,6 +44,8 @@ import google.registry.model.annotations.NotBackedUp;
 import google.registry.model.annotations.NotBackedUp.Reason;
 import google.registry.model.annotations.VirtualEntity;
 import google.registry.model.common.CrossTldSingleton;
+import google.registry.schema.tmch.ClaimsList;
+import google.registry.schema.tmch.ClaimsListDao;
 import google.registry.util.CollectionUtils;
 import google.registry.util.Concurrent;
 import google.registry.util.Retrier;
@@ -71,6 +77,8 @@ import org.joda.time.DateTime;
@NotBackedUp(reason = Reason.EXTERNALLY_SOURCED)
 public class ClaimsListShard extends ImmutableObject {

+  private static final FluentLogger logger = FluentLogger.forEnclosingClass();
+
  /** The number of claims list entries to store per shard. */
  private static final int SHARD_SIZE = 10000;

@@ -112,8 +120,7 @@ public class ClaimsListShard extends ImmutableObject {
                Concurrent.transform(
                    shardKeys,
                    key ->
-                        tm()
-                            .transactNewReadOnly(
+                        tm().transactNewReadOnly(
                                () -> {
                                  ClaimsListShard claimsListShard = ofy().load().key(key).now();
                                  checkState(
@@ -142,9 +149,52 @@ public class ClaimsListShard extends ImmutableObject {
            }
          }
        }
-        return create(creationTime, ImmutableMap.copyOf(combinedLabelsToKeys));
+
+        ClaimsListShard datastoreList =
+            create(creationTime, ImmutableMap.copyOf(combinedLabelsToKeys));
+        // Also load the list from Cloud SQL, compare the two lists, and log if different.
+        try {
+          loadAndCompareCloudSqlList(datastoreList);
+        } catch (Throwable t) {
+          logger.atSevere().withCause(t).log("Error comparing reserved lists.");
+        }
+        return datastoreList;
      };

+  private static final void loadAndCompareCloudSqlList(ClaimsListShard datastoreList) {
+    Optional<ClaimsList> maybeCloudSqlList = ClaimsListDao.getLatestRevision();
+    if (maybeCloudSqlList.isPresent()) {
+      ClaimsList cloudSqlList = maybeCloudSqlList.get();
+      MapDifference<String, String> diff =
+          Maps.difference(datastoreList.labelsToKeys, cloudSqlList.getLabelsToKeys());
+      if (!diff.areEqual()) {
+        if (diff.entriesDiffering().size() > 10) {
+          logger.atWarning().log(
+              String.format(
+                  "Unequal claims lists detected, Cloud SQL list with revision id %d has %d"
+                      + " different records than the current Datastore list.",
+                  cloudSqlList.getRevisionId(), diff.entriesDiffering().size()));
+        } else {
+          StringBuilder diffMessage = new StringBuilder("Unequal claims lists detected:\n");
+          diff.entriesDiffering().entrySet().stream()
+              .forEach(
+                  entry -> {
+                    String label = entry.getKey();
+                    ValueDifference<String> valueDiff = entry.getValue();
+                    diffMessage.append(
+                        String.format(
+                            "Domain label %s has key %s in Datastore and key %s in Cloud"
+                                + " SQL.\n",
+                            label, valueDiff.leftValue(), valueDiff.rightValue()));
+                  });
+          logger.atWarning().log(diffMessage.toString());
+        }
+      }
+    } else {
+      logger.atWarning().log("Claims list in Cloud SQL is empty.");
+    }
+  }
+
  /**
   * A cached supplier that fetches the claims list shards from Datastore and recombines them into a
   * single {@link ClaimsListShard} object.
--- a/core/src/main/java/google/registry/model/transaction/JpaTransactionManagerImpl.java
+++ b/core/src/main/java/google/registry/model/transaction/JpaTransactionManagerImpl.java
@@ -16,6 +16,7 @@ package google.registry.model.transaction;

 import com.google.common.flogger.FluentLogger;
 import google.registry.util.Clock;
+import java.util.function.Supplier;
 import javax.persistence.EntityManager;
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.EntityTransaction;
@@ -63,11 +64,11 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T transact(Work<T> work) {
+  public <T> T transact(Supplier<T> work) {
    // TODO(shicong): Investigate removing transactNew functionality after migration as it may
    //  be same as this one.
    if (inTransaction()) {
-      return work.run();
+      return work.get();
    }
    TransactionInfo txnInfo = transactionInfo.get();
    txnInfo.entityManager = emf.createEntityManager();
@@ -76,7 +77,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
      txn.begin();
      txnInfo.inTransaction = true;
      txnInfo.transactionTime = clock.nowUtc();
-      T result = work.run();
+      T result = work.get();
      txn.commit();
      return result;
    } catch (RuntimeException e) {
@@ -102,7 +103,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T transactNew(Work<T> work) {
+  public <T> T transactNew(Supplier<T> work) {
    // TODO(shicong): Implements the functionality to start a new transaction.
    throw new UnsupportedOperationException();
  }
@@ -114,7 +115,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T transactNewReadOnly(Work<T> work) {
+  public <T> T transactNewReadOnly(Supplier<T> work) {
    // TODO(shicong): Implements read only transaction.
    throw new UnsupportedOperationException();
  }
@@ -126,7 +127,7 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
  }

  @Override
-  public <T> T doTransactionless(Work<T> work) {
+  public <T> T doTransactionless(Supplier<T> work) {
    // TODO(shicong): Implements doTransactionless.
    throw new UnsupportedOperationException();
  }
--- a/core/src/main/java/google/registry/model/transaction/TransactionManager.java
+++ b/core/src/main/java/google/registry/model/transaction/TransactionManager.java
@@ -14,6 +14,7 @@

 package google.registry.model.transaction;

+import java.util.function.Supplier;
 import org.joda.time.DateTime;

 /**
@@ -21,12 +22,6 @@ import org.joda.time.DateTime;
 */
 public interface TransactionManager {

-  /** This functional interface defines a method to execute a work and return the result. */
-  @FunctionalInterface
-  interface Work<R> {
-    R run();
-  }
-
  /** Returns {@code true} if the caller is in a transaction.
   *
   *  <p>Note that this function is kept for backward compatibility. We will review the use case
@@ -42,18 +37,19 @@ public interface TransactionManager {
  void assertInTransaction();

  /** Executes the work in a transaction and returns the result. */
-  <T> T transact(Work<T> work);
+  <T> T transact(Supplier<T> work);

  /** Executes the work in a transaction. */
  void transact(Runnable work);

-  /** Pauses the current transaction (if any), executes the work in a new transaction
-   *  and returns the result.
+  /**
+   * Pauses the current transaction (if any), executes the work in a new transaction and returns the
+   * result.
   *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
   */
-  <T> T transactNew(Work<T> work);
+  <T> T transactNew(Supplier<T> work);

  /** Pauses the current transaction (if any) and executes the work in a new transaction.
   *
@@ -62,12 +58,13 @@ public interface TransactionManager {
   */
  void transactNew(Runnable work);

-  /** Executes the work in a read-only transaction and returns the result.
+  /**
+   * Executes the work in a read-only transaction and returns the result.
   *
-   *  <p>Note that this function is kept for backward compatibility. We will review the use case
-   *  later when adding the cloud sql implementation.
+   * <p>Note that this function is kept for backward compatibility. We will review the use case
+   * later when adding the cloud sql implementation.
   */
-  <R> R transactNewReadOnly(Work<R> work);
+  <R> R transactNewReadOnly(Supplier<R> work);

  /** Executes the work in a read-only transaction.
   *
@@ -77,7 +74,7 @@ public interface TransactionManager {
  void transactNewReadOnly(Runnable work);

  /** Executes the work in a transactionless context. */
-  <R> R doTransactionless(Work<R> work);
+  <R> R doTransactionless(Supplier<R> work);

  /** Returns the time associated with the start of this particular transaction attempt. */
  DateTime getTransactionTime();
--- a/core/src/main/java/google/registry/persistence/EnumSetUserType.java
+++ b/core/src/main/java/google/registry/persistence/EnumSetUserType.java
@@ -0,0 +1,37 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import java.util.HashSet;
+import java.util.Set;
+
+/** Abstract Hibernate user type for storing/retrieving {@link Set<Enum<E>>}. */
+public class EnumSetUserType<E extends Enum<E>> extends GenericCollectionUserType<Set<Enum<E>>> {
+
+  @Override
+  Set<Enum<E>> getNewCollection() {
+    return new HashSet<Enum<E>>();
+  }
+
+  @Override
+  ArrayColumnType getColumnType() {
+    return ArrayColumnType.STRING;
+  }
+
+  @Override
+  public Class returnedClass() {
+    return Set.class;
+  }
+}
--- a/core/src/main/java/google/registry/persistence/GenericCollectionUserType.java
+++ b/core/src/main/java/google/registry/persistence/GenericCollectionUserType.java
@@ -0,0 +1,98 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import java.sql.Array;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Types;
+import java.util.Collection;
+import org.hibernate.HibernateException;
+import org.hibernate.engine.spi.SharedSessionContractImplementor;
+
+/** Generic Hibernate user type to store/retrieve Java collection as an array in Cloud SQL. */
+public abstract class GenericCollectionUserType<T extends Collection> extends MutableUserType {
+
+  abstract T getNewCollection();
+
+  abstract ArrayColumnType getColumnType();
+
+  enum ArrayColumnType {
+    STRING(Types.ARRAY, "text");
+
+    final int typeCode;
+    final String typeName;
+
+    ArrayColumnType(int typeCode, String typeName) {
+      this.typeCode = typeCode;
+      this.typeName = typeName;
+    }
+
+    int getTypeCode() {
+      return typeCode;
+    }
+
+    String getTypeName() {
+      return typeName;
+    }
+
+    String getTypeDdlName() {
+      return typeName + "[]";
+    }
+  }
+
+  @Override
+  public int[] sqlTypes() {
+    return new int[] {getColumnType().getTypeCode()};
+  }
+
+  @Override
+  public Object nullSafeGet(
+      ResultSet rs, String[] names, SharedSessionContractImplementor session, Object owner)
+      throws HibernateException, SQLException {
+    if (rs.getArray(names[0]) != null) {
+      T result = getNewCollection();
+      for (Object element : (Object[]) rs.getArray(names[0]).getArray()) {
+        result.add(convertToElem(element));
+      }
+      return result;
+    }
+    return null;
+  }
+
+  @Override
+  public void nullSafeSet(
+      PreparedStatement st, Object value, int index, SharedSessionContractImplementor session)
+      throws HibernateException, SQLException {
+    if (value == null) {
+      st.setArray(index, null);
+      return;
+    }
+    T list = (T) value;
+    Array arr = st.getConnection().createArrayOf(getColumnType().getTypeName(), list.toArray());
+    st.setArray(index, arr);
+  }
+
+  /**
+   * Override this to convert an element value retrieved from the database to a different type.
+   *
+   * <p>This method is useful when encoding a java type to one of the types that can be used as an
+   * array element.
+   */
+  protected Object convertToElem(Object columnValue) {
+    return columnValue;
+  }
+}
--- a/core/src/main/java/google/registry/persistence/HibernateSchemaExporter.java
+++ b/core/src/main/java/google/registry/persistence/HibernateSchemaExporter.java
@@ -32,6 +32,9 @@ import org.hibernate.tool.schema.TargetType;

 /** Utility class to export DDL script for given {@link javax.persistence.Entity} classes. */
 public class HibernateSchemaExporter {
+  // Hibernate proprietary mappings.
+  private static final String HIBERNATE_MAPPING_RESOURCES = "META-INF/orm.xml";
+
  private final String jdbcUrl;
  private final String username;
  private final String password;
@@ -63,6 +66,7 @@ public class HibernateSchemaExporter {
    try (StandardServiceRegistry registry =
        new StandardServiceRegistryBuilder().applySettings(settings).build()) {
      MetadataSources metadata = new MetadataSources(registry);
+      metadata.addResource(HIBERNATE_MAPPING_RESOURCES);

      // Note that we need to also add all converters to the Hibernate context because
      // the entity class may use the customized type.
--- a/core/src/main/java/google/registry/persistence/MapUserType.java
+++ b/core/src/main/java/google/registry/persistence/MapUserType.java
@@ -0,0 +1,57 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Types;
+import java.util.Map;
+import org.hibernate.HibernateException;
+import org.hibernate.engine.spi.SharedSessionContractImplementor;
+import org.hibernate.usertype.UserType;
+
+/**
+ * A custom {@link UserType} used to convert a Java {@link Map<String, String>} to/from PostgreSQL
+ * hstore type. Per this <a href="https://www.postgresql.org/docs/current/hstore.html">doc</a>, as
+ * hstore keys and values are simply text strings, the type of key and value in the Java map has to
+ * be {@link String} as well.
+ */
+public class MapUserType extends MutableUserType {
+
+  @Override
+  public int[] sqlTypes() {
+    return new int[] {Types.OTHER};
+  }
+
+  @Override
+  public Class returnedClass() {
+    return Map.class;
+  }
+
+  @Override
+  public Object nullSafeGet(
+      ResultSet rs, String[] names, SharedSessionContractImplementor session, Object owner)
+      throws HibernateException, SQLException {
+    return rs.getObject(names[0]);
+  }
+
+  @Override
+  public void nullSafeSet(
+      PreparedStatement st, Object value, int index, SharedSessionContractImplementor session)
+      throws HibernateException, SQLException {
+    st.setObject(index, value);
+  }
+}
--- a/core/src/main/java/google/registry/persistence/MutableUserType.java
+++ b/core/src/main/java/google/registry/persistence/MutableUserType.java
@@ -0,0 +1,63 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import java.io.Serializable;
+import java.util.Objects;
+import org.hibernate.HibernateException;
+import org.hibernate.usertype.UserType;
+
+/**
+ * An abstract class represents a mutable Hibernate user type which implements related methods
+ * defined in {@link UserType}.
+ */
+public abstract class MutableUserType implements UserType {
+
+  @Override
+  public boolean equals(Object x, Object y) throws HibernateException {
+    return Objects.equals(x, y);
+  }
+
+  @Override
+  public int hashCode(Object x) throws HibernateException {
+    return x == null ? 0 : x.hashCode();
+  }
+
+  // TODO(b/147489651): Investigate how to properly implement the below methods.
+  @Override
+  public Object deepCopy(Object value) throws HibernateException {
+    return value;
+  }
+
+  @Override
+  public boolean isMutable() {
+    return false;
+  }
+
+  @Override
+  public Serializable disassemble(Object value) throws HibernateException {
+    return (Serializable) value;
+  }
+
+  @Override
+  public Object assemble(Serializable cached, Object owner) throws HibernateException {
+    return cached;
+  }
+
+  @Override
+  public Object replace(Object original, Object target, Object owner) throws HibernateException {
+    return original;
+  }
+}
--- a/core/src/main/java/google/registry/persistence/NomulusPostgreSQLDialect.java
+++ b/core/src/main/java/google/registry/persistence/NomulusPostgreSQLDialect.java
@@ -13,6 +13,7 @@
 // limitations under the License.
 package google.registry.persistence;

+import google.registry.persistence.GenericCollectionUserType.ArrayColumnType;
 import java.sql.Types;
 import org.hibernate.dialect.PostgreSQL95Dialect;

@@ -23,5 +24,9 @@ public class NomulusPostgreSQLDialect extends PostgreSQL95Dialect {
    registerColumnType(Types.VARCHAR, "text");
    registerColumnType(Types.TIMESTAMP_WITH_TIMEZONE, "timestamptz");
    registerColumnType(Types.TIMESTAMP, "timestamptz");
+    registerColumnType(Types.OTHER, "hstore");
+    for (ArrayColumnType arrayType : ArrayColumnType.values()) {
+      registerColumnType(arrayType.getTypeCode(), arrayType.getTypeDdlName());
+    }
  }
 }
--- a/core/src/main/java/google/registry/persistence/StringListUserType.java
+++ b/core/src/main/java/google/registry/persistence/StringListUserType.java
@@ -0,0 +1,37 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import com.google.common.collect.Lists;
+import java.util.List;
+
+/** Abstract Hibernate user type for storing/retrieving {@link List<String>}. */
+public class StringListUserType extends GenericCollectionUserType<List<String>> {
+
+  @Override
+  List<String> getNewCollection() {
+    return Lists.newArrayList();
+  }
+
+  @Override
+  ArrayColumnType getColumnType() {
+    return ArrayColumnType.STRING;
+  }
+
+  @Override
+  public Class returnedClass() {
+    return List.class;
+  }
+}
--- a/core/src/main/java/google/registry/persistence/StringSetUserType.java
+++ b/core/src/main/java/google/registry/persistence/StringSetUserType.java
@@ -1,4 +1,4 @@
-// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,17 +12,26 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-plugins {
-  id 'java-library'
-}
+package google.registry.persistence;

-sourceSets {
-  main {
-    java {
-      srcDirs = [
-          "${rootDir}/third_party/junit/"
-      ]
-      include '**/*.java'
-    }
+import com.google.common.collect.Sets;
+import java.util.Set;
+
+/** Abstract Hibernate user type for storing/retrieving {@link Set<String>}. */
+public class StringSetUserType extends GenericCollectionUserType<Set<String>> {
+
+  @Override
+  Set<String> getNewCollection() {
+    return Sets.newHashSet();
+  }
+
+  @Override
+  ArrayColumnType getColumnType() {
+    return ArrayColumnType.STRING;
+  }
+
+  @Override
+  public Class returnedClass() {
+    return Set.class;
  }
 }
--- a/core/src/main/java/google/registry/rde/BrdaCopyAction.java
+++ b/core/src/main/java/google/registry/rde/BrdaCopyAction.java
@@ -58,7 +58,7 @@ import org.joda.time.DateTime;
    path = BrdaCopyAction.PATH,
    method = POST,
    automaticallyPrintOk = true,
-    auth = Auth.AUTH_INTERNAL_ONLY)
+    auth = Auth.AUTH_INTERNAL_OR_ADMIN)
 public final class BrdaCopyAction implements Runnable {

  static final String PATH = "/_dr/task/brdaCopy";
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Shicong Huang	ad2cf933c2	Add dual read for ReservedList (#423 ) * Add dual read for ReservedList * Extract loading cloud sql list to a method	2020-01-17 15:49:58 -05:00
Weimin Yu	3a9e5d398e	Remove MapUserTypeTest from Integration TestSuite (#449 ) * Remove MapUserTypeTest from Integration TestSuite	2020-01-17 14:14:14 -05:00
Michael Muller	2009540f8b	Implement a hibernate type for enums (#446 ) * Implement a hibernate type for enums Leverage GenericCollectionUserType to store enum fields as an array of strings. * Changes requested in review * Remove extraneous import Curiously, this causes checkstyle to fail now that the import was /removed from a comment./	2020-01-16 14:56:41 -05:00
sarahcaseybot	ca0d95b066	Fix exDate calculation in domain transfer flows (#389 ) * Fix exDate calculation in domain transfer flows * Link ICANN rule for zero-period transfer * Get rid of some unnecessary method parameters * Add domain info commands to test case	2020-01-15 16:43:39 -05:00
Shicong Huang	851465a89d	Relax reserved list existence check to allow Cloud SQL migration (#429 )	2020-01-15 13:10:50 -05:00
Shicong Huang	6aa7c19344	Add MapUserType to support converstion between Map and hstore (#443 )	2020-01-15 10:37:14 -05:00
Lai Jiang	cf0e8e1b26	Use monitoring client v1.0.7 (#445 ) This version of the monitoring client no longer depends on backported JUnit classes.	2020-01-14 23:11:54 -05:00
Weimin Yu	c90d5ed43b	Fix flaky SQL integration tests (#441 ) * Fix flaky SQL integration tests As a sanity check, the text fixture verifies that all test jdbc connections have been closed. However, the query to get the connection count is too general, and may count background admin tasks such as autovacuum and replication etc, that may appear at any time.	2020-01-14 10:59:55 -05:00
Weimin Yu	e106e25800	Upgradle JUnit to 4.13 (#442 ) * Upgradle JUnit to 4.13 Removed third_party/junit folder and all usage of the JunitBackPort class. As a result, third_party is no longer a Gradle subproject. Minor code changes were needed to work around an error-prone pattern: multiple statement in assertThrows' runnable lambda. Also third_party/activation and third_party/jsch. These dependencies are loaded from remote maven repo. The local copies are not in use.	2020-01-14 10:54:09 -05:00
Michael Muller	54471e2714	Fix procedure for schema generation (#436 ) * Fix procedure for schema generation	2020-01-13 07:41:20 -05:00
Weimin Yu	bd5299b2f2	Print more info during compatibility test (#440 ) * Print more info during compatibility test Prints a summary of the environments to be tested and their corresponding version tags.	2020-01-10 15:52:27 -05:00
Shicong Huang	4eae10800d	Add user types to support Array in Cloud SQL (#439 ) * Add user types to support Array in Cloud SQL * Remove duplicate null check * Simplify class structure	2020-01-10 14:54:21 -05:00
Weimin Yu	533515817f	Make Jacoco work with multiple test tasks (#437 ) * Make Jacoco work with multiple test tasks By default Jacoco only looks at execution data from the 'test' task. This is a problem to 'core' which has multiple test sets.	2020-01-09 16:32:33 -05:00
Weimin Yu	d4b1048363	Upload Cloud Build schema-deploy config to GCS (#435 ) * Upload Cloud Build schema-deploy config to GCS Forgot to upload cloudbuild-schema-deploy.yaml to GCS.	2020-01-09 15:04:10 -05:00
Weimin Yu	2ffcfc4c5e	Fix outdated comment (#433 ) * Fix outdated comment Removed reference to a testcontainer issues that may no longer exist.	2020-01-08 16:02:04 -05:00
Weimin Yu	b47e152ca5	Add script to run compatibility tests (#431 ) A helper script to run server/schema compatibility tests from a CI platform. It allows the caller to choose a system under test (sql or nomulus) and to specify the deployed version by environment (sandbox or production).	2020-01-08 11:34:09 -05:00
Michael Muller	b523b3835f	Implement changes suggested by testcontainer dev (#426 ) * Implement changes suggested by testcontainer dev See https://github.com/google/nomulus/issues/401 Specifically: - Use getContainerIpAddress() instead of localhost to insulate us from off-machine docker usage. - Remove shutdown hook to close the container, as testcontainers does this for us.	2020-01-08 10:41:36 -05:00
Ben McIlwain	eb7d779bc8	Relax premium list existence check to allow Cloud SQL migration (#428 ) * Relax premium list existence check to allow Cloud SQL migration We need to be able to simultaneously update premium lists that already exist in Datastore and create them in Cloud SQL (because they haven't been migrated over yet). This temporarily relaxes the existence check for Cloud SQL so that "updates" will work even when the list doesn't yet exist there.	2020-01-06 18:09:21 -05:00
Lai Jiang	8fb12d21a2	Use the correct certificate provider type (#427 ) TESTED: tested in alpha. Previous I only tested locally and missed this typo.	2020-01-06 16:19:50 -05:00
sarahcaseybot	5d9bf64b96	Fix IcannReportingUploadAction to upload reports from the previous month (#425 ) * Fix IcannReportingUploadAction to upload reports from the previous month getFileName now sets the file name of the report to upload to use the month before cursor time. IcannReportingUploadAction no longer uploads the MANIFEST.txt file since it is not required based on (https://tools.ietf.org/html/draft-lozano-icann-registry-interfaces-07#page-9) and the previous implementation of this action did not upload it. Deletes the ICANN_UPLOAD_MANIFEST cursor since it is no loner needed. * Add the ICANN_UPLOAD_MANIFEST cursor back	2020-01-06 15:59:01 -05:00
Lai Jiang	76603812e3	Create kzip file for Kythe cross-referencing (#424 ) This is set up per b/141716384. TESTED=Tested on alpha and successfully uploaded the merged kzip file to GCS.	2020-01-03 16:57:39 -05:00
Shicong Huang	a28754dc5d	Add dual read claims list (#413 ) * Add dual read claims list * Improve warning log and use longer duration for cache * Extract the comparison logic to a method * Move cache to DAO	2020-01-03 10:59:34 -05:00
Weimin Yu	d6bf6f375e	Fix flakiness in JodaMoneyConverterTest (#421 ) * Fix flakiness in JodaMoneyConverterTest JpdaMoneyConverterTest relies on Hibernate to deploy its schema. This introduces an extra jdbc connection in the middle of a test suite, and may break the connection count checks between tests made by JpaTransactionManagerRule. This change updated HibernateSchemaExporter to include Hibernate proprietary mappings in META-INF/orm.xml. This change also disabled Hibernate schema push for all tests, and enabled sql statement logging.	2020-01-02 11:51:20 -05:00
Ben McIlwain	8f67c4b9cf	Support premium list updating in Cloud SQL (#422 ) * Support premium list updating in Cloud SQL This also removes the requirement to specify --also_cloud_sql in nomulus premium list tooling, instead always persisting to Cloud SQL. It removes a non-USD premium label in the global test premium list (the Cloud SQL schema doesn't support a mix of currency units in a single premium list). And it adds a method to PremiumListDao to grab the most recent version of a given list. * Merge branch 'master' into premium-lists-always-cloud-sql * Revert test change * Create new PremiumListUtils class and refactor out existing method * Fix tests and update an existing premium price	2020-01-02 11:30:58 -05:00
gbrodman	c17a5c489c	Add unlock fields to RegistryLocks (#408 ) * Add unlock fields to RegistryLocks This will make it easier to reason around inter-connected registry lock objects (like when we add dependent roids). It will make it easier to answer the question of "Have all locks associated with this host/contact roid been unlocked?", as well as the question of "Was the last lock object associated with this domain unlocked?" * Responses to CR * Make the DAO API more specific * whoops, undo rename	2019-12-30 14:34:06 -07:00
Lai Jiang	dd0e3b7c24	Consolidate certificate supplier module (#410 ) * Consolidate certificate supplier module Both the proxy and the proxy needs certificate suppliers. The PR consolidates the module that providings those bindings to a shared module and switched the proxy to use that module. The prober currently uses P12 file to store its certificates. I am debating keeping that supplier ro converting them to PEM files for simplicity. * Rename mode enum values to be more descriptive * Update annotation names to be more descriptive	2019-12-23 13:09:47 -05:00
Weimin Yu	24d671c070	Separate JPA rules for unit and integration tests (#420 ) * Separate JPA rules for unit and integration tests Define two subclasses of JpaTransactionManagerRule, one for unit tests and the other for integration tests. The difference is that the former does not need nomulus schema and need not be included in server/schema compatibility tests. * Separate JPA rules for unit and integration tests Define two subclasses of JpaTransactionManagerRule, one for unit tests and the other for integration tests. The difference is that the former does not need nomulus schema and need not be included in server/schema compatibility tests.	2019-12-19 14:49:54 -05:00
Shicong Huang	f76030f7f0	Add initial support to write/update reserved lists to Cloud SQL (#388 ) * Add initial support to write reserved list to Cloud SQL * Add support to update reserved list in Cloud SQL * Fix wrong check when override is enabled in create command * Add sql dependent tests to the suite * Address comment * Make invocation of super.execute more readable * Add test to check upper case and non-puny code label * Move ReservedListDao related classes to schema package * Simplify a function name	2019-12-19 12:51:48 -05:00
Shicong Huang	f301314d97	Move ClaimsListDao related classes to new package (#416 )	2019-12-19 10:50:41 -05:00
gbrodman	25d43511f6	Add BCC capabilities to the Spec11 reports (#418 ) * Add BCC capabilities to the Spec11 reports	2019-12-18 17:08:06 -05:00
Lai Jiang	bfd61ef867	Fix another bug in the proxy (#419 ) The promise should be set outside the try block because if we want warning only, we still want the promise to be set even if the clientCertificate.checkValidity() throws an error.	2019-12-18 16:24:23 -05:00
Weimin Yu	ffe3eb1548	Remove the schema jar url override for tests (#415 ) * Remove the schema jar url override for tests Revert pull request 374: "Allow schema-loading from arbitrary url in tests". Pull request 403 (`f48e3933f5`) is a more general solution. This reverts commit `68887d427f`.	2019-12-17 11:24:20 -05:00
Weimin Yu	6aaf081489	Create a new app to hold GenerateSqlSchemaCommand (#409 ) * Create a new app to hold GenerateSqlSchemaCommand GenerateSqlSchemaCommand starts postgresql using testcontainer. This makes junit etc a runtime dependency, allowing them to get into release artifacts. By moving this command to a separate tool, we can remove junit etc as compile/runtime dependency.	2019-12-13 16:05:35 -05:00
Weimin Yu	1143b25391	Fix test on use of external schema jar (#412 ) * Fix test on use of external schema jar One test breaks if path to external schema is set and test is run from the sqlIntegrationTest task.	2019-12-13 11:32:19 -05:00
Weimin Yu	65cf49f204	Fix sql script name conflict (#411 ) * Fix sql script name conflict There are two V11__ files due to concurrent merge. Renamed one to V12__ Also removed a @NotNull annotation, which is the fist in the code base. Most of the code base use @Nullable instead. If we do want to use @NotNull, we may want to use the javax one instead.	2019-12-12 16:16:43 -05:00
Weimin Yu	f48e3933f5	Run cross-release SQL integration tests (#403 ) * Run cross-release SQL integration tests Run SQL integration tests across arbitrary schema and server releases. Refer to integration/README.md in this change for more information. TESTED=Cloud build changes tested with cloud-build-local Used the published jars to test sqlIntegration task locally.	2019-12-12 13:47:49 -05:00
Lai Jiang	9853f23d94	Fix null pointer excpetion bug (#407 ) The factory method passes a null trustedCertificates instead of an empty list.	2019-12-12 13:06:43 -05:00
Ben McIlwain	db7fcf6c38	Add Cloud SQL premium list caches and compare prices with Datastore (#376 ) * Add Cloud SQL premium list caches and compare prices with Datastore Nothing will fail if the prices can't be loaded from Cloud SQL, or if the prices are different. All that happens is that the error is logged. Then, once this is running in production for awhile, we'll look at the logs and see if there will be any pricing implications from switching over to the Cloud SQL version of the premium lists. * Add setMaxResults(1) per code review * Add tests and reorder public functions * Don't statically import caches * Improve test pass rate * Merge branch 'master' into dual-read-premium * Add PremiumEntry mapping * Allow update * Revert column order * Alphabetize PremiumEntry columns * Don't bother trying to enforce order * Private constructor	2019-12-11 16:20:19 -05:00
Weimin Yu	3aad8b6aa7	Use TextDiffSubject to compare multi-line text (#406 ) * Use TextDiffSubject to compare multi-line text It illustrates differences better. Moved TextDiffSubject.java to the common project for sharing.	2019-12-10 16:44:59 -05:00
Weimin Yu	f7b243e390	Make devProject a project property (#405 ) * Make devProject a project property Properties set in rootProject's ext block are not overridden by commandline flags. * Make flyway commands runnable from FOSS repo rootProject.devProject, defined in projects.gradle, cannot be overridden by commandline flags. Added a flag check in :db's project script.	2019-12-10 11:39:56 -05:00
Michael Muller	e8745f7538	Update lockfiles (#402 ) * Update lockfiles Update lockfiles for the latest dependencies and metadata.	2019-12-10 09:28:44 -05:00
sarahcaseybot	2478a4a93b	Add schema and DAO for cursors in cloudsql (#370 ) * Add schema for Cursor * Add CursorDao and CursorDaoTest * Fix comment on getTld * Change tld column to scope * Fix cursorTime to be converted to DateTime internally and other small fixes * Add a CursorType enum and a createGlobal constructor for Cursor * Rename flyway file * Use cursorType from common/Cursor.java and add null checks	2019-12-09 17:47:06 -05:00
Weimin Yu	bba5aff4b6	Verify RegistryTool can instantiate (#400 ) * Verify RegistryTool can instantiate Add a task that instantiates all command classes in RegistryTool with runtimeClasspath. Also make sure that runtimeClasspath is a superset of compileClasspath.	2019-12-06 12:08:16 -05:00
Michael Muller	df7d272157	Adding junit back into the runtime classpath (#399 ) * Adding junit back into the runtime classpath Unfortunately, GenerateSqlSchemaCommand depends on junit via testcontainers. We should really move GenerateSqlSchemaCommand out of nomulus tool (we only use it during development) but this gets nomulus tool working for the time being. * Removed unnnecessary trace line. * lockfiles generated after update_dependency.sh	2019-12-05 16:01:05 -05:00
Shicong Huang	988f78274e	Check SQL dependency in super class for SqlIntegrationMembershipTest (#398 ) In some cases, we define JpaTransactionManagerRule in a TestCase class which is extended by the concrete test class. So, we need to check if JpaTransactionManagerRule is also defined in the super class.	2019-12-05 13:12:56 -05:00
Lai Jiang	369c1259fb	Remove AUTH_INTERNAL_ONLY (#393 ) Endpoints annotated with AUTH_INTERNAL_ONLY used to be accessible manually with an internal RPC tool that adds App Engine specific HTTP headers to a request to make it look like it comes from App Engine (hence internal). This tool is used by admins to hit such endpoints during debugging, making them effectively AUTH_INTERNAL_OR_ADMIN. This RPC tool has never been made available outside Google so the open source admins do not have such ability. A recent change in the RPC tool made this hack stop working internally as well. This PR replaces all all occurances of AUTH_INTERNAL_ONLY with AUTH_INTERNAL_OR_ADMIN and brings the open source build into feature parity with the internal version. Also fixed a few issues the router tests.	2019-12-04 12:52:18 -05:00
Michael Muller	1e1c8cdd80	Replace TransactionManager.Work with Supplier (#397 ) * Replace TransactionManager.Work with Supplier Replace the "Work" class with the equivalent java.util.function.Supplier.	2019-12-04 12:00:13 -05:00
Weimin Yu	3d3d390a9f	Fix bad dependency lock file (#396 ) * Fix bad dependency lock file	2019-12-03 13:31:57 -05:00
Weimin Yu	f0fc53e035	Allow project dependency to use runtimeClasspath (#395 ) * Allow project dependency to use runtimeClasspath Project dependency should use runtimeClasspath. However, if left unspecified, it uses 'default', which is the same as the legacy 'runtime' configuration. (runtimeOnly dependencies are left out). Since runtimeClasspath cannot be referenced directly, we use a custom config (deploy_jar) as a proxy. By excluding testjars (leaked into 'compile' by third-party dependencies) from runtimeClasspath, we prevent them from getting into release artifacts. Two meaningful changes in appengine_war.gradle and java_common.gradle TESTED=Diffed contents of services/{module}/build/exploded-* Only three jars are removed: hamcrest-core, junit, and mockito-core.	2019-12-02 16:10:13 -05:00
Lai Jiang	c156842844	Upgrade to Gradle 6.0.1 (#394 )	2019-12-02 15:24:18 -05:00