Make Gradle dependency cache shareable in GCB (#479)

* Make Gradle dependency cache shareable in GCB

Make Gradle put its caches in the source tree so that
they can be preserved across steps. When left at their
default location, caches are lost after each step.

.gitignore

@@ -97,6 +97,7 @@ nomulus.iws
 !/gradle/wrapper/**/*.jar
 .gradle/
 **/build
+cloudbuild-caches/
 node_modules/**
 /repos/
 

config/presubmits.py

@@ -22,7 +22,7 @@ import sys
 import re
 
 # We should never analyze any generated files
-UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "/out/"}
+UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/"}
 # We can't rely on CI to have the Enum package installed so we do this instead.
 FORBIDDEN = 1
 REQUIRED = 2

core/src/main/java/google/registry/model/EppResource.java

@@ -53,7 +53,6 @@ import java.util.concurrent.ExecutionException;
 import javax.persistence.Column;
 import javax.persistence.MappedSuperclass;
 import javax.persistence.Transient;
-import org.hibernate.annotations.Type;
 import org.joda.time.DateTime;
 import org.joda.time.Duration;
 
@@ -117,7 +116,6 @@ public abstract class EppResource extends BackupGroupRoot implements Buildable {
   DateTime lastEppUpdateTime;
 
   /** Status values associated with this resource. */
-  @Type(type = "google.registry.model.eppcommon.StatusValue$StatusValueSetType")
   @Column(name = "statuses")
   // TODO(mmuller): rename to "statuses" once we're off datastore.
   Set<StatusValue> status;

core/src/main/java/google/registry/model/domain/DomainBase.java

@@ -185,7 +185,6 @@ public class DomainBase extends EppResource
   String idnTableName;
 
   /** Fully qualified host names of this domain's active subordinate hosts. */
-  @org.hibernate.annotations.Type(type = "google.registry.persistence.StringSetUserType")
   Set<String> subordinateHosts;
 
   /** When this domain's registration will expire. */

core/src/main/java/google/registry/model/eppcommon/StatusValue.java

@@ -25,7 +25,6 @@ import google.registry.model.domain.DomainBase;
 import google.registry.model.host.HostResource;
 import google.registry.model.translators.EnumToAttributeAdapter.EppEnum;
 import google.registry.model.translators.StatusValueAdapter;
-import google.registry.persistence.EnumSetUserType;
 import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 
 /**
@@ -166,11 +165,4 @@ public enum StatusValue implements EppEnum {
     return StatusValue.valueOf(LOWER_CAMEL.to(UPPER_UNDERSCORE, nullToEmpty(xmlName)));
   }
 
-  /** Hibernate type for sets of {@link StatusValue}. */
-  public static class StatusValueSetType extends EnumSetUserType<StatusValue> {
-    @Override
-    protected StatusValue convertToElem(String value) {
-      return StatusValue.valueOf(value);
-    }
-  }
 }

core/src/main/java/google/registry/model/registrar/Registrar.java

@@ -262,15 +262,12 @@ public class Registrar extends ImmutableObject implements Buildable, Jsonifiable
   State state;
 
   /** The set of TLDs which this registrar is allowed to access. */
-  // TODO(b/147908600): Investigate how to automatically apply user type
-  @org.hibernate.annotations.Type(type = "google.registry.persistence.StringSetUserType")
   Set<String> allowedTlds;
 
   /** Host name of WHOIS server. */
   String whoisServer;
 
   /** Base URLs for the registrar's RDAP servers. */
-  @org.hibernate.annotations.Type(type = "google.registry.persistence.StringSetUserType")
   Set<String> rdapBaseUrls;
 
   /**
@@ -298,7 +295,6 @@ public class Registrar extends ImmutableObject implements Buildable, Jsonifiable
   String failoverClientCertificateHash;
 
   /** A whitelist of netmasks (in CIDR notation) which the client is allowed to connect from. */
-  @org.hibernate.annotations.Type(type = "google.registry.persistence.CidrAddressBlockListUserType")
   List<CidrAddressBlock> ipAddressWhitelist;
 
   /** A hashed password for EPP access. The hash is a base64 encoded SHA256 string. */

core/src/main/java/google/registry/model/registrar/RegistrarContact.java

@@ -45,6 +45,9 @@ import google.registry.model.annotations.ReportedOn;
 import java.util.Arrays;
 import java.util.Map;
 import java.util.Set;
+import javax.persistence.Column;
+import javax.persistence.Table;
+import javax.persistence.Transient;
 
 /**
  * A contact for a Registrar. Note, equality, hashCode and comparable have been overridden to only
@@ -56,10 +59,16 @@ import java.util.Set;
  */
 @ReportedOn
 @Entity
+@javax.persistence.Entity
+@Table(
+    name = "RegistrarPoc",
+    indexes = {
+      @javax.persistence.Index(columnList = "gaeUserId", name = "registrarpoc_gae_user_id_idx")
+    })
+// TODO(shicong): Rename the class name to RegistrarPoc after database migration
 public class RegistrarContact extends ImmutableObject implements Jsonifiable {
 
-  @Parent
-  Key<Registrar> parent;
+  @Parent @Transient Key<Registrar> parent;
 
   /**
    * Registrar contacts types for partner communication tracking.
@@ -99,6 +108,8 @@ public class RegistrarContact extends ImmutableObject implements Jsonifiable {
 
   /** The email address of the contact. */
   @Id
+  @javax.persistence.Id
+  @Column(nullable = false)
   String emailAddress;
 
   /** The voice number of the contact. */
@@ -108,8 +119,8 @@ public class RegistrarContact extends ImmutableObject implements Jsonifiable {
   String faxNumber;
 
   /**
-   * Multiple types are used to associate the registrar contact with
-   * various mailing groups. This data is internal to the registry.
+   * Multiple types are used to associate the registrar contact with various mailing groups. This
+   * data is internal to the registry.
    */
   Set<Type> types;
 

core/src/main/java/google/registry/persistence/CidrAddressBlockListConverter.java

@@ -16,20 +16,24 @@ package google.registry.persistence;
 
 import google.registry.util.CidrAddressBlock;
 import java.util.List;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
 
 /**
- * Hibernate {@link org.hibernate.usertype.UserType} for storing/retrieving {@link
- * List<CidrAddressBlock>} objects.
+ * JPA {@link AttributeConverter} for storing/retrieving {@link List<CidrAddressBlock>} objects.
+ * TODO(shicong): Investigate if we can have one converter for any List type
  */
-public class CidrAddressBlockListUserType extends StringListUserType<CidrAddressBlock> {
+@Converter(autoApply = true)
+public class CidrAddressBlockListConverter extends StringListConverterBase<CidrAddressBlock> {
 
   @Override
-  protected CidrAddressBlock convertToElem(String columnValue) {
-    return columnValue == null ? null : CidrAddressBlock.create(columnValue);
+  String toString(CidrAddressBlock element) {
+    return element.toString();
   }
 
   @Override
-  protected String convertToColumn(CidrAddressBlock elementValue) {
-    return elementValue == null ? null : elementValue.toString();
+  CidrAddressBlock fromString(String value) {
+    return CidrAddressBlock.create(value);
   }
+
 }

core/src/main/java/google/registry/persistence/GenericCollectionUserType.java

@@ -1,119 +0,0 @@
-// Copyright 2020 The Nomulus Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package google.registry.persistence;
-
-import google.registry.util.TypeUtils.TypeInstantiator;
-import java.sql.Array;
-import java.sql.PreparedStatement;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.sql.Types;
-import java.util.Collection;
-import org.hibernate.HibernateException;
-import org.hibernate.engine.spi.SharedSessionContractImplementor;
-
-/**
- * Generic Hibernate user type to store/retrieve Java collection as an array in Cloud SQL.
- *
- * @param <T> the concrete {@link Collection} type of the entity field
- * @param <E> the Java type of the element for the collection of the entity field
- * @param <C> the JDBC supported type of the element in the DB column array
- */
-public abstract class GenericCollectionUserType<T extends Collection<E>, E, C>
-    extends MutableUserType {
-
-  abstract T getNewCollection();
-
-  abstract ArrayColumnType getColumnType();
-
-  enum ArrayColumnType {
-    STRING(Types.ARRAY, "text");
-
-    final int typeCode;
-    final String typeName;
-
-    ArrayColumnType(int typeCode, String typeName) {
-      this.typeCode = typeCode;
-      this.typeName = typeName;
-    }
-
-    int getTypeCode() {
-      return typeCode;
-    }
-
-    String getTypeName() {
-      return typeName;
-    }
-
-    String getTypeDdlName() {
-      return typeName + "[]";
-    }
-  }
-
-  @Override
-  public Class returnedClass() {
-    return new TypeInstantiator<T>(getClass()) {}.getExactType();
-  }
-
-  @Override
-  public int[] sqlTypes() {
-    return new int[] {getColumnType().getTypeCode()};
-  }
-
-  @Override
-  public Object nullSafeGet(
-      ResultSet rs, String[] names, SharedSessionContractImplementor session, Object owner)
-      throws HibernateException, SQLException {
-    if (rs.getArray(names[0]) != null) {
-      T result = getNewCollection();
-      for (C element : (C[]) rs.getArray(names[0]).getArray()) {
-        result.add(convertToElem(element));
-      }
-      return result;
-    }
-    return null;
-  }
-
-  @Override
-  public void nullSafeSet(
-      PreparedStatement st, Object value, int index, SharedSessionContractImplementor session)
-      throws HibernateException, SQLException {
-    if (value == null) {
-      st.setArray(index, null);
-      return;
-    }
-    T collection = (T) value;
-    Array arr =
-        st.getConnection()
-            .createArrayOf(
-                getColumnType().getTypeName(),
-                collection.stream().map(this::convertToColumn).toArray());
-    st.setArray(index, arr);
-  }
-
-  /**
-   * Override this to convert an element value retrieved from the database to a different type.
-   *
-   * <p>This method is useful when encoding a java type to one of the types that can be used as an
-   * array element.
-   */
-  protected E convertToElem(C columnValue) {
-    return (E) columnValue;
-  }
-
-  protected C convertToColumn(E elementValue) {
-    return (C) elementValue;
-  }
-}

core/src/main/java/google/registry/persistence/NomulusPostgreSQLDialect.java

@@ -13,9 +13,10 @@
 // limitations under the License.
 package google.registry.persistence;
 
-import google.registry.persistence.GenericCollectionUserType.ArrayColumnType;
 import java.sql.Types;
+import org.hibernate.boot.model.TypeContributions;
 import org.hibernate.dialect.PostgreSQL95Dialect;
+import org.hibernate.service.ServiceRegistry;
 
 /** Nomulus mapping rules for column types in Postgresql. */
 public class NomulusPostgreSQLDialect extends PostgreSQL95Dialect {
@@ -25,8 +26,15 @@ public class NomulusPostgreSQLDialect extends PostgreSQL95Dialect {
     registerColumnType(Types.TIMESTAMP_WITH_TIMEZONE, "timestamptz");
     registerColumnType(Types.TIMESTAMP, "timestamptz");
     registerColumnType(Types.OTHER, "hstore");
-    for (ArrayColumnType arrayType : ArrayColumnType.values()) {
-      registerColumnType(arrayType.getTypeCode(), arrayType.getTypeDdlName());
-    }
+    registerColumnType(
+        StringCollectionDescriptor.COLUMN_TYPE, StringCollectionDescriptor.COLUMN_DDL_NAME);
+  }
+
+  @Override
+  public void contributeTypes(
+      TypeContributions typeContributions, ServiceRegistry serviceRegistry) {
+    super.contributeTypes(typeContributions, serviceRegistry);
+    typeContributions.contributeJavaTypeDescriptor(new StringCollectionDescriptor());
+    typeContributions.contributeSqlTypeDescriptor(new StringCollectionDescriptor());
   }
 }

core/src/main/java/google/registry/persistence/RegistrarPocSetConverter.java

@@ -14,25 +14,21 @@
 
 package google.registry.persistence;
 
-import java.util.HashSet;
+import google.registry.model.registrar.RegistrarContact.Type;
 import java.util.Set;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
 
-/** Abstract Hibernate user type for storing/retrieving {@link Set<Enum<E>>}. */
-public class EnumSetUserType<E extends Enum<E>>
-    extends GenericCollectionUserType<Set<E>, E, String> {
-
+/** JPA {@link AttributeConverter} for storing/retrieving {@link Set<Type>}. */
+@Converter(autoApply = true)
+public class RegistrarPocSetConverter extends StringSetConverterBase<Type> {
   @Override
-  Set<E> getNewCollection() {
-    return new HashSet<>();
+  String toString(Type element) {
+    return element.name();
   }
 
   @Override
-  ArrayColumnType getColumnType() {
-    return ArrayColumnType.STRING;
-  }
-
-  @Override
-  public Class returnedClass() {
-    return Set.class;
+  Type fromString(String value) {
+    return Type.valueOf(value);
   }
 }

core/src/main/java/google/registry/persistence/StatusValueSetConverter.java

@@ -0,0 +1,35 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import google.registry.model.eppcommon.StatusValue;
+import java.util.Set;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
+
+/** JPA {@link AttributeConverter} for storing/retrieving {@link Set<StatusValue>}. */
+@Converter(autoApply = true)
+public class StatusValueSetConverter extends StringSetConverterBase<StatusValue> {
+
+  @Override
+  String toString(StatusValue element) {
+    return element.name();
+  }
+
+  @Override
+  StatusValue fromString(String value) {
+    return StatusValue.valueOf(value);
+  }
+}

core/src/main/java/google/registry/persistence/StringCollectionDescriptor.java

@@ -0,0 +1,187 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static google.registry.persistence.StringCollectionDescriptor.StringCollection;
+
+import com.google.common.collect.ImmutableList;
+import java.sql.Array;
+import java.sql.CallableStatement;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Types;
+import java.util.Collection;
+import org.hibernate.type.descriptor.ValueBinder;
+import org.hibernate.type.descriptor.ValueExtractor;
+import org.hibernate.type.descriptor.WrapperOptions;
+import org.hibernate.type.descriptor.java.AbstractTypeDescriptor;
+import org.hibernate.type.descriptor.java.JavaTypeDescriptor;
+import org.hibernate.type.descriptor.spi.JdbcRecommendedSqlTypeMappingContext;
+import org.hibernate.type.descriptor.sql.BasicBinder;
+import org.hibernate.type.descriptor.sql.BasicExtractor;
+import org.hibernate.type.descriptor.sql.SqlTypeDescriptor;
+
+/**
+ * The {@link JavaTypeDescriptor} and {@link SqlTypeDescriptor} for {@link StringCollection}.
+ *
+ * <p>A {@link StringCollection} object is a simple wrapper for a {@link Collection<String>} which
+ * can be stored as a string array in the database. The {@link JavaTypeDescriptor} and {@link
+ * SqlTypeDescriptor} is used by JPA/Hibernate to map between the collection and {@link Array} which
+ * is the actual type that JDBC uses to read from and write to the database.
+ *
+ * @see <a
+ *     href="https://docs.jboss.org/hibernate/orm/current/userguide/html_single/Hibernate_User_Guide.html#basic-jpa-convert">JPA
+ *     2.1 AttributeConverters</a>
+ */
+public class StringCollectionDescriptor extends AbstractTypeDescriptor<StringCollection>
+    implements SqlTypeDescriptor {
+  public static final int COLUMN_TYPE = Types.ARRAY;
+  public static final String COLUMN_NAME = "text";
+  public static final String COLUMN_DDL_NAME = COLUMN_NAME + "[]";
+
+  protected StringCollectionDescriptor() {
+    super(StringCollection.class);
+  }
+
+  @Override
+  public StringCollection fromString(String string) {
+    throw new UnsupportedOperationException(
+        "Constructing StringCollectionDescriptor from string is not allowed");
+  }
+
+  @Override
+  public <X> X unwrap(StringCollection value, Class<X> type, WrapperOptions options) {
+    if (value == null) {
+      return null;
+    }
+    if (Collection.class.isAssignableFrom(type)) {
+      return (X) value.getCollection();
+    }
+    throw unknownUnwrap(type);
+  }
+
+  @Override
+  public <X> StringCollection wrap(X value, WrapperOptions options) {
+    if (value == null) {
+      return null;
+    }
+    if (value instanceof Array) {
+      try {
+        String[] arr = (String[]) ((Array) value).getArray();
+        ImmutableList.Builder<String> builder = new ImmutableList.Builder<>();
+        for (String str : arr) {
+          builder.add(str);
+        }
+        return StringCollection.create(builder.build());
+      } catch (SQLException e) {
+        throw new RuntimeException(e);
+      }
+    }
+    throw unknownWrap(value.getClass());
+  }
+
+  @Override
+  public SqlTypeDescriptor getJdbcRecommendedSqlType(JdbcRecommendedSqlTypeMappingContext context) {
+    return this;
+  }
+
+  @Override
+  public int getSqlType() {
+    return COLUMN_TYPE;
+  }
+
+  @Override
+  public boolean canBeRemapped() {
+    return false;
+  }
+
+  @Override
+  public <X> ValueBinder<X> getBinder(JavaTypeDescriptor<X> javaTypeDescriptor) {
+    return new BasicBinder<X>(javaTypeDescriptor, this) {
+      @Override
+      protected void doBind(PreparedStatement st, X value, int index, WrapperOptions options)
+          throws SQLException {
+        if (value == null) {
+          st.setArray(index, null);
+          return;
+        }
+        if (value instanceof StringCollection) {
+          StringCollection stringCollection = (StringCollection) value;
+          if (stringCollection.getCollection() == null) {
+            st.setArray(index, null);
+          } else {
+            st.setArray(
+                index,
+                st.getConnection()
+                    .createArrayOf(COLUMN_NAME, stringCollection.getCollection().toArray()));
+          }
+        } else {
+          throw new UnsupportedOperationException(
+              String.format(
+                  "Binding type %s is not supported by StringCollectionDescriptor",
+                  value.getClass().getName()));
+        }
+      }
+
+      @Override
+      protected void doBind(CallableStatement st, X value, String name, WrapperOptions options)
+          throws SQLException {
+        // CallableStatement.setArray() doesn't have an overload version for setting array by its
+        // column name
+        throw new UnsupportedOperationException(
+            "Binding array by its column name is not supported");
+      }
+    };
+  }
+
+  @Override
+  public <X> ValueExtractor<X> getExtractor(JavaTypeDescriptor<X> javaTypeDescriptor) {
+    return new BasicExtractor<X>(javaTypeDescriptor, this) {
+      @Override
+      protected X doExtract(ResultSet rs, String name, WrapperOptions options) throws SQLException {
+        return javaTypeDescriptor.wrap(rs.getArray(name), options);
+      }
+
+      @Override
+      protected X doExtract(CallableStatement statement, int index, WrapperOptions options)
+          throws SQLException {
+        return javaTypeDescriptor.wrap(statement.getArray(index), options);
+      }
+
+      @Override
+      protected X doExtract(CallableStatement statement, String name, WrapperOptions options)
+          throws SQLException {
+        return javaTypeDescriptor.wrap(statement.getArray(name), options);
+      }
+    };
+  }
+
+  public static class StringCollection {
+    private Collection<String> collection;
+
+    private StringCollection(Collection<String> collection) {
+      this.collection = collection;
+    }
+
+    public static StringCollection create(Collection<String> collection) {
+      return new StringCollection(collection);
+    }
+
+    public Collection<String> getCollection() {
+      return collection;
+    }
+  }
+}

core/src/main/java/google/registry/persistence/StringListConverter.java

@@ -14,19 +14,21 @@
 
 package google.registry.persistence;
 
-import com.google.common.collect.Lists;
 import java.util.List;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
 
-/** Abstract Hibernate user type for storing/retrieving {@link List<String>}. */
-public class StringListUserType<E> extends GenericCollectionUserType<List<E>, E, String> {
+/** JPA {@link AttributeConverter} for storing/retrieving {@link List<String>}. */
+@Converter(autoApply = true)
+public class StringListConverter extends StringListConverterBase<String> {
 
   @Override
-  List<E> getNewCollection() {
-    return Lists.newArrayList();
+  String toString(String element) {
+    return element;
   }
 
   @Override
-  ArrayColumnType getColumnType() {
-    return ArrayColumnType.STRING;
+  String fromString(String value) {
+    return value;
   }
 }

core/src/main/java/google/registry/persistence/StringListConverterBase.java

@@ -0,0 +1,48 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+
+import google.registry.persistence.StringCollectionDescriptor.StringCollection;
+import java.util.List;
+import javax.persistence.AttributeConverter;
+
+/**
+ * Base JPA converter for {@link List} objects that are stored as an array of strings in the
+ * database.
+ */
+public abstract class StringListConverterBase<T>
+    implements AttributeConverter<List<T>, StringCollection> {
+
+  abstract String toString(T element);
+
+  abstract T fromString(String value);
+
+  @Override
+  public StringCollection convertToDatabaseColumn(List<T> attribute) {
+    return attribute == null
+        ? null
+        : StringCollection.create(
+            attribute.stream().map(this::toString).collect(toImmutableList()));
+  }
+
+  @Override
+  public List<T> convertToEntityAttribute(StringCollection dbData) {
+    return dbData == null || dbData.getCollection() == null
+        ? null
+        : dbData.getCollection().stream().map(this::fromString).collect(toImmutableList());
+  }
+}

core/src/main/java/google/registry/persistence/StringSetConverter.java

@@ -14,19 +14,21 @@
 
 package google.registry.persistence;
 
-import com.google.common.collect.Sets;
 import java.util.Set;
+import javax.persistence.AttributeConverter;
+import javax.persistence.Converter;
 
-/** Abstract Hibernate user type for storing/retrieving {@link Set<String>}. */
-public class StringSetUserType<E> extends GenericCollectionUserType<Set<E>, E, String> {
+/** JPA {@link AttributeConverter} for storing/retrieving {@link Set<String>}. */
+@Converter(autoApply = true)
+public class StringSetConverter extends StringSetConverterBase<String> {
 
   @Override
-  Set<E> getNewCollection() {
-    return Sets.newHashSet();
+  String toString(String element) {
+    return element;
   }
 
   @Override
-  ArrayColumnType getColumnType() {
-    return ArrayColumnType.STRING;
+  String fromString(String value) {
+    return value;
   }
 }

core/src/main/java/google/registry/persistence/StringSetConverterBase.java

@@ -0,0 +1,47 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.persistence;
+
+import static com.google.common.collect.ImmutableSet.toImmutableSet;
+
+import google.registry.persistence.StringCollectionDescriptor.StringCollection;
+import java.util.Set;
+import javax.persistence.AttributeConverter;
+
+/**
+ * Base JPA converter for {@link Set} objects that are stored as an array of strings in the
+ * database.
+ */
+public abstract class StringSetConverterBase<T>
+    implements AttributeConverter<Set<T>, StringCollection> {
+
+  abstract String toString(T element);
+
+  abstract T fromString(String value);
+
+  @Override
+  public StringCollection convertToDatabaseColumn(Set<T> attribute) {
+    return attribute == null
+        ? null
+        : StringCollection.create(attribute.stream().map(this::toString).collect(toImmutableSet()));
+  }
+
+  @Override
+  public Set<T> convertToEntityAttribute(StringCollection dbData) {
+    return dbData == null || dbData.getCollection() == null
+        ? null
+        : dbData.getCollection().stream().map(this::fromString).collect(toImmutableSet());
+  }
+}

core/src/main/java/google/registry/tools/CreateOrUpdateReservedListCommand.java

@@ -62,12 +62,6 @@ public abstract class CreateOrUpdateReservedListCommand extends MutatingCommand
       arity = 1)
   Boolean shouldPublish;
 
-  @Parameter(
-      names = {"--also_cloud_sql"},
-      description =
-          "Persist reserved list to Cloud SQL in addition to Datastore; defaults to false.")
-  boolean alsoCloudSql;
-
   google.registry.schema.tld.ReservedList cloudSqlReservedList;
 
   abstract void saveToCloudSql();
@@ -78,23 +72,18 @@ public abstract class CreateOrUpdateReservedListCommand extends MutatingCommand
     String output = super.execute();
     logger.atInfo().log(output);
 
-    String cloudSqlMessage;
-    if (alsoCloudSql) {
+    String cloudSqlMessage =
+        String.format(
+            "Saved reserved list %s with %d entries",
+            name, cloudSqlReservedList.getLabelsToReservations().size());
+    try {
+      logger.atInfo().log("Saving reserved list to Cloud SQL for TLD %s", name);
+      saveToCloudSql();
+      logger.atInfo().log(cloudSqlMessage);
+    } catch (Throwable e) {
       cloudSqlMessage =
-          String.format(
-              "Saved reserved list %s with %d entries",
-              name, cloudSqlReservedList.getLabelsToReservations().size());
-      try {
-        logger.atInfo().log("Saving reserved list to Cloud SQL for TLD %s", name);
-        saveToCloudSql();
-        logger.atInfo().log(cloudSqlMessage);
-      } catch (Throwable e) {
-        cloudSqlMessage =
-            "Unexpected error saving reserved list to Cloud SQL from nomulus tool command";
-        logger.atSevere().withCause(e).log(cloudSqlMessage);
-      }
-    } else {
-      cloudSqlMessage = "Persisting reserved list to Cloud SQL is not enabled";
+          "Unexpected error saving reserved list to Cloud SQL from nomulus tool command";
+      logger.atSevere().withCause(e).log(cloudSqlMessage);
     }
     return cloudSqlMessage;
   }

core/src/main/java/google/registry/tools/CreateReservedListCommand.java

@@ -67,11 +67,9 @@ final class CreateReservedListCommand extends CreateOrUpdateReservedListCommand
             .setLastUpdateTime(now)
             .build();
     stageEntityChange(null, reservedList);
-    if (alsoCloudSql) {
-      cloudSqlReservedList =
-          google.registry.schema.tld.ReservedList.create(
-              name, shouldPublish, parseToReservationsByLabels(allLines));
-    }
+    cloudSqlReservedList =
+        google.registry.schema.tld.ReservedList.create(
+            name, shouldPublish, parseToReservationsByLabels(allLines));
   }
 
   @Override

core/src/main/java/google/registry/tools/UpdateReservedListCommand.java

@@ -50,11 +50,9 @@ final class UpdateReservedListCommand extends CreateOrUpdateReservedListCommand
             .setLastUpdateTime(new SystemClock().nowUtc())
             .setShouldPublish(shouldPublish);
     stageEntityChange(existing.get(), updated.build());
-    if (alsoCloudSql) {
-      cloudSqlReservedList =
-          google.registry.schema.tld.ReservedList.create(
-              name, shouldPublish, parseToReservationsByLabels(allLines));
-    }
+    cloudSqlReservedList =
+        google.registry.schema.tld.ReservedList.create(
+            name, shouldPublish, parseToReservationsByLabels(allLines));
   }
 
   @Override

core/src/main/java/google/registry/tools/UploadClaimsListCommand.java

@@ -37,11 +37,6 @@ final class UploadClaimsListCommand extends ConfirmingCommand implements Command
   @Parameter(description = "Claims list filename")
   private List<String> mainParameters = new ArrayList<>();
 
-  @Parameter(
-      names = {"--also_cloud_sql"},
-      description = "Persist claims list to Cloud SQL in addition to Datastore; defaults to false.")
-  boolean alsoCloudSql;
-
   private String claimsListFilename;
 
   private ClaimsList claimsList;
@@ -64,9 +59,7 @@ final class UploadClaimsListCommand extends ConfirmingCommand implements Command
   @Override
   public String execute() {
     ClaimsListShard.create(claimsList.getTmdbGenerationTime(), claimsList.getLabelsToKeys()).save();
-    if (alsoCloudSql) {
-      ClaimsListDao.trySave(claimsList);
-    }
+    ClaimsListDao.trySave(claimsList);
     return String.format("Successfully uploaded claims list %s", claimsListFilename);
   }
 }

core/src/main/resources/META-INF/persistence.xml

@@ -21,6 +21,7 @@
     -->
     <class>google.registry.model.domain.DomainBase</class>
     <class>google.registry.model.registrar.Registrar</class>
+    <class>google.registry.model.registrar.RegistrarContact</class>
     <class>google.registry.schema.domain.RegistryLock</class>
     <class>google.registry.schema.tmch.ClaimsList</class>
     <class>google.registry.schema.cursor.Cursor</class>
@@ -38,9 +39,14 @@
 
     <!-- Customized type converters -->
     <class>google.registry.persistence.BloomFilterConverter</class>
+    <class>google.registry.persistence.CidrAddressBlockListConverter</class>
     <class>google.registry.persistence.CreateAutoTimestampConverter</class>
     <class>google.registry.persistence.CurrencyUnitConverter</class>
     <class>google.registry.persistence.DateTimeConverter</class>
+    <class>google.registry.persistence.RegistrarPocSetConverter</class>
+    <class>google.registry.persistence.StatusValueSetConverter</class>
+    <class>google.registry.persistence.StringListConverter</class>
+    <class>google.registry.persistence.StringSetConverter</class>
     <class>google.registry.persistence.UpdateAutoTimestampConverter</class>
     <class>google.registry.persistence.ZonedDateTimeConverter</class>
 

core/src/test/java/google/registry/persistence/CidrAddressBlockListUserTypeTest.java

@@ -25,13 +25,12 @@ import google.registry.util.CidrAddressBlock;
 import java.util.List;
 import javax.persistence.Entity;
 import javax.persistence.Id;
-import org.hibernate.annotations.Type;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 
-/** Unit tests for {@link CidrAddressBlockListUserType}. */
+/** Unit tests for {@link CidrAddressBlockListConverter}. */
 @RunWith(JUnit4.class)
 public class CidrAddressBlockListUserTypeTest {
   @Rule
@@ -59,7 +58,6 @@ public class CidrAddressBlockListUserTypeTest {
 
     @Id String name = "id";
 
-    @Type(type = "google.registry.persistence.CidrAddressBlockListUserType")
     List<CidrAddressBlock> addresses;
 
     private TestEntity() {}

core/src/test/java/google/registry/persistence/StatusValueSetConverterTest.java

@@ -18,29 +18,27 @@ import static com.google.common.truth.Truth.assertThat;
 import static google.registry.persistence.transaction.TransactionManagerFactory.jpaTm;
 
 import com.google.common.collect.ImmutableSet;
+import google.registry.model.eppcommon.StatusValue;
 import google.registry.persistence.transaction.JpaTestRules;
 import google.registry.persistence.transaction.JpaTestRules.JpaUnitTestRule;
 import java.util.Set;
 import javax.persistence.Entity;
 import javax.persistence.Id;
-import org.hibernate.annotations.Type;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 
-/** Unit tests for {@link EnumSetUserType}. */
+/** Unit tests for {@link StatusValueSetConverter}. */
 @RunWith(JUnit4.class)
-public class EnumSetUserTypeTest {
+public class StatusValueSetConverterTest {
   @Rule
   public final JpaUnitTestRule jpaRule =
       new JpaTestRules.Builder().withEntityClass(TestEntity.class).buildUnitTestRule();
 
-  public EnumSetUserTypeTest() {}
-
   @Test
   public void testRoundTrip() {
-    Set<TestEnum> enums = ImmutableSet.of(TestEnum.BAR, TestEnum.FOO);
+    Set<StatusValue> enums = ImmutableSet.of(StatusValue.INACTIVE, StatusValue.PENDING_DELETE);
     TestEntity obj = new TestEntity("foo", enums);
 
     jpaTm().transact(() -> jpaTm().getEntityManager().persist(obj));
@@ -49,29 +47,15 @@ public class EnumSetUserTypeTest {
     assertThat(persisted.data).isEqualTo(enums);
   }
 
-  enum TestEnum {
-    FOO,
-    BAR,
-    BAZ;
-
-    public static class TestEnumType extends EnumSetUserType<TestEnum> {
-      @Override
-      protected TestEnum convertToElem(String value) {
-        return TestEnum.valueOf(value);
-      }
-    }
-  }
-
   @Entity(name = "TestEntity")
   static class TestEntity {
     @Id String name;
 
-    @Type(type = "google.registry.persistence.EnumSetUserTypeTest$TestEnum$TestEnumType")
-    Set<TestEnum> data;
+    Set<StatusValue> data;
 
     TestEntity() {}
 
-    TestEntity(String name, Set<TestEnum> data) {
+    TestEntity(String name, Set<StatusValue> data) {
       this.name = name;
       this.data = data;
     }

core/src/test/java/google/registry/persistence/StringListConverterTest.java

@@ -26,15 +26,14 @@ import java.util.List;
 import javax.persistence.Entity;
 import javax.persistence.Id;
 import javax.persistence.NoResultException;
-import org.hibernate.annotations.Type;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 
-/** Unit tests for {@link StringListUserType}. */
+/** Unit tests for {@link StringListConverter}. */
 @RunWith(JUnit4.class)
-public class StringListUserTypeTest {
+public class StringListConverterTest {
   @Rule
   public final JpaUnitTestRule jpaRule =
       new JpaTestRules.Builder().withEntityClass(TestEntity.class).buildUnitTestRule();
@@ -123,7 +122,6 @@ public class StringListUserTypeTest {
 
     @Id String name = "id";
 
-    @Type(type = "google.registry.persistence.StringListUserType")
     List<String> tlds;
 
     private TestEntity() {}

core/src/test/java/google/registry/persistence/StringSetConverterTest.java

@@ -24,15 +24,14 @@ import google.registry.persistence.transaction.JpaTestRules.JpaUnitTestRule;
 import java.util.Set;
 import javax.persistence.Entity;
 import javax.persistence.Id;
-import org.hibernate.annotations.Type;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 
-/** Unit tests for {@link StringSetUserType}. */
+/** Unit tests for {@link StringSetConverter}. */
 @RunWith(JUnit4.class)
-public class StringSetUserTypeTest {
+public class StringSetConverterTest {
   @Rule
   public final JpaUnitTestRule jpaRule =
       new JpaTestRules.Builder().withEntityClass(TestEntity.class).buildUnitTestRule();
@@ -70,7 +69,6 @@ public class StringSetUserTypeTest {
 
     @Id String name = "id";
 
-    @Type(type = "google.registry.persistence.StringSetUserType")
     Set<String> tlds;
 
     private TestEntity() {}

core/src/test/java/google/registry/tools/CreateReservedListCommandTest.java

@@ -178,8 +178,7 @@ public class CreateReservedListCommandTest extends
 
   @Test
   public void testSaveToCloudSql_succeeds() throws Exception {
-    runCommandForced(
-        "--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath, "--also_cloud_sql");
+    runCommandForced("--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath);
     verifyXnq9jyb4cInDatastore();
     verifyXnq9jyb4cInCloudSql();
   }
@@ -193,8 +192,7 @@ public class CreateReservedListCommandTest extends
             "xn--q9jyb4c_common-reserved",
             true,
             ImmutableMap.of("testdomain", ReservedEntry.create(FULLY_BLOCKED, ""))));
-    runCommandForced(
-        "--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath, "--also_cloud_sql");
+    runCommandForced("--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath);
     verifyXnq9jyb4cInDatastore();
   }
 

core/src/test/java/google/registry/tools/UpdateReservedListCommandTest.java

@@ -116,20 +116,18 @@ public class UpdateReservedListCommandTest extends
   public void testSaveToCloudSql_succeeds() throws Exception {
     populateInitialReservedListInDatastore(true);
     populateInitialReservedListInCloudSql(true);
-    runCommandForced(
-        "--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath, "--also_cloud_sql");
+    runCommandForced("--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath);
     verifyXnq9jyb4cInDatastore();
     verifyXnq9jyb4cInCloudSql();
   }
 
   @Test
   public void testSaveToCloudSql_succeedsEvenPreviousListNotExist() throws Exception {
-    // Note that, during the dual-write phase, we just always save the revered list to
-    // Cloud SQL (if --also_cloud_sql is set) without checking if there is a list with
-    // same name. This is to backfill the existing list in Datastore when we update it.
+    // Note that, during the dual-write phase, we always save the reserved list to Cloud SQL without
+    // checking if there is a list with same name. This is to backfill the existing list in Cloud
+    // Datastore when we update it.
     populateInitialReservedListInDatastore(true);
-    runCommandForced(
-        "--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath, "--also_cloud_sql");
+    runCommandForced("--name=xn--q9jyb4c_common-reserved", "--input=" + reservedTermsPath);
     verifyXnq9jyb4cInDatastore();
     assertThat(ReservedListDao.checkExists("xn--q9jyb4c_common-reserved")).isTrue();
   }

db/src/main/resources/sql/flyway/V17__create_registrar_poc.sql

@@ -0,0 +1,31 @@
+-- Copyright 2020 The Nomulus Authors. All Rights Reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+create table "RegistrarPoc" (
+       email_address text not null,
+        allowed_to_set_registry_lock_password boolean not null,
+        fax_number text,
+        gae_user_id text,
+        name text,
+        phone_number text,
+        registry_lock_password_hash text,
+        registry_lock_password_salt text,
+        types text[],
+        visible_in_domain_whois_as_abuse boolean not null,
+        visible_in_whois_as_admin boolean not null,
+        visible_in_whois_as_tech boolean not null,
+        primary key (email_address)
+    );
+
+create index registrarpoc_gae_user_id_idx on "RegistrarPoc" (gae_user_id);

db/src/main/resources/sql/schema/db-schema.sql.generated

@@ -142,6 +142,22 @@
         primary key (client_id)
     );
 
+    create table "RegistrarPoc" (
+       email_address text not null,
+        allowed_to_set_registry_lock_password boolean not null,
+        fax_number text,
+        gae_user_id text,
+        name text,
+        phone_number text,
+        registry_lock_password_hash text,
+        registry_lock_password_salt text,
+        types text[],
+        visible_in_domain_whois_as_abuse boolean not null,
+        visible_in_whois_as_admin boolean not null,
+        visible_in_whois_as_tech boolean not null,
+        primary key (email_address)
+    );
+
     create table "RegistryLock" (
        revision_id  bigserial not null,
         domain_name text not null,
@@ -181,6 +197,7 @@ create index IDXrwl38wwkli1j7gkvtywi9jokq on "Domain" (tld);
 create index premiumlist_name_idx on "PremiumList" (name);
 create index registrar_name_idx on "Registrar" (registrar_name);
 create index registrar_iana_identifier_idx on "Registrar" (iana_identifier);
+create index registrarpoc_gae_user_id_idx on "RegistrarPoc" (gae_user_id);
 create index idx_registry_lock_verification_code on "RegistryLock" (verification_code);
 create index idx_registry_lock_registrar_id on "RegistryLock" (registrar_id);
 

db/src/main/resources/sql/schema/nomulus.golden.sql

@@ -212,6 +212,26 @@ CREATE TABLE public."Registrar" (
 );
 
 
+--
+-- Name: RegistrarPoc; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public."RegistrarPoc" (
+    email_address text NOT NULL,
+    allowed_to_set_registry_lock_password boolean NOT NULL,
+    fax_number text,
+    gae_user_id text,
+    name text,
+    phone_number text,
+    registry_lock_password_hash text,
+    registry_lock_password_salt text,
+    types text[],
+    visible_in_domain_whois_as_abuse boolean NOT NULL,
+    visible_in_whois_as_admin boolean NOT NULL,
+    visible_in_whois_as_tech boolean NOT NULL
+);
+
+
 --
 -- Name: RegistryLock; Type: TABLE; Schema: public; Owner: -
 --
@@ -370,6 +390,14 @@ ALTER TABLE ONLY public."PremiumList"
     ADD CONSTRAINT "PremiumList_pkey" PRIMARY KEY (revision_id);
 
 
+--
+-- Name: RegistrarPoc RegistrarPoc_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public."RegistrarPoc"
+    ADD CONSTRAINT "RegistrarPoc_pkey" PRIMARY KEY (email_address);
+
+
 --
 -- Name: Registrar Registrar_pkey; Type: CONSTRAINT; Schema: public; Owner: -
 --
@@ -480,6 +508,13 @@ CREATE INDEX registrar_iana_identifier_idx ON public."Registrar" USING btree (ia
 CREATE INDEX registrar_name_idx ON public."Registrar" USING btree (registrar_name);
 
 
+--
+-- Name: registrarpoc_gae_user_id_idx; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX registrarpoc_gae_user_id_idx ON public."RegistrarPoc" USING btree (gae_user_id);
+
+
 --
 -- Name: reservedlist_name_idx; Type: INDEX; Schema: public; Owner: -
 --

java_common.gradle

@@ -115,6 +115,7 @@ spotless {
   format 'misc', {
     clearSteps()
     target '**/*.gradle'
+    targetExclude '**/cloudbuild-caches/**'
     trimTrailingWhitespace()
     indentWithSpaces(2)
     endWithNewline()

networking/build.gradle

@@ -41,12 +41,6 @@ dependencies {
   testAnnotationProcessor deps['com.google.dagger:dagger-compiler']
 }
 
-test {
-  // Temporarily allow non-CA cert as trust anchor (legacy behavior) in tests.
-  // TODO(weiminyu): generate test cert as a CA cert.
-  systemProperty 'jdk.security.allowNonCaAnchor', 'true'
-}
-
 // Make testing artifacts available to be depended up on by other projects.
 task testJar(type: Jar) {
   classifier = 'test'

networking/src/main/java/google/registry/networking/module/CertificateSupplierModule.java

@@ -25,7 +25,7 @@ import com.google.common.collect.ImmutableList;
 import dagger.Lazy;
 import dagger.Module;
 import dagger.Provides;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
+import google.registry.networking.util.SelfSignedCaCertificate;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -163,9 +163,9 @@ public final class CertificateSupplierModule {
 
   @Singleton
   @Provides
-  static SelfSignedCertificate provideSelfSignedCertificate() {
+  static SelfSignedCaCertificate provideSelfSignedCertificate() {
     try {
-      return new SelfSignedCertificate();
+      return SelfSignedCaCertificate.create();
     } catch (Exception e) {
       throw new RuntimeException(e);
     }
@@ -174,7 +174,7 @@ public final class CertificateSupplierModule {
   @Singleton
   @Provides
   @SelfSigned
-  static Supplier<PrivateKey> provideSelfSignedPrivateKeySupplier(SelfSignedCertificate ssc) {
+  static Supplier<PrivateKey> provideSelfSignedPrivateKeySupplier(SelfSignedCaCertificate ssc) {
     return Suppliers.ofInstance(ssc.key());
   }
 
@@ -182,7 +182,7 @@ public final class CertificateSupplierModule {
   @Provides
   @SelfSigned
   static Supplier<ImmutableList<X509Certificate>> provideSelfSignedCertificatesSupplier(
-      SelfSignedCertificate ssc) {
+      SelfSignedCaCertificate ssc) {
     return Suppliers.ofInstance(ImmutableList.of(ssc.cert()));
   }
 

networking/src/main/java/google/registry/networking/util/SelfSignedCaCertificate.java

@@ -0,0 +1,112 @@
+// Copyright 2020 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.networking.util;
+
+import java.math.BigInteger;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.PrivateKey;
+import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Date;
+import java.util.Random;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.BasicConstraints;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+
+/** A self-signed certificate authority (CA) cert for use in tests. */
+// TODO(weiminyu): make this class test-only. Requires refactor in proxy and prober.
+public class SelfSignedCaCertificate {
+
+  private static final String DEFAULT_ISSUER_FQDN = "registry-test";
+  private static final Date DEFAULT_NOT_BEFORE =
+      Date.from(Instant.now().minus(Duration.ofHours(1)));
+  private static final Date DEFAULT_NOT_AFTER = Date.from(Instant.now().plus(Duration.ofDays(1)));
+
+  private static final Random RANDOM = new Random();
+  private static final BouncyCastleProvider PROVIDER = new BouncyCastleProvider();
+  private static final KeyPairGenerator keyGen = createKeyPairGenerator();
+
+  private final PrivateKey privateKey;
+  private final X509Certificate cert;
+
+  public SelfSignedCaCertificate(PrivateKey privateKey, X509Certificate cert) {
+    this.privateKey = privateKey;
+    this.cert = cert;
+  }
+
+  public PrivateKey key() {
+    return privateKey;
+  }
+
+  public X509Certificate cert() {
+    return cert;
+  }
+
+  public static SelfSignedCaCertificate create() throws Exception {
+    return create(
+        keyGen.generateKeyPair(), DEFAULT_ISSUER_FQDN, DEFAULT_NOT_BEFORE, DEFAULT_NOT_AFTER);
+  }
+
+  public static SelfSignedCaCertificate create(String fqdn) throws Exception {
+    return create(fqdn, DEFAULT_NOT_BEFORE, DEFAULT_NOT_AFTER);
+  }
+
+  public static SelfSignedCaCertificate create(String fqdn, Date from, Date to) throws Exception {
+    return create(keyGen.generateKeyPair(), fqdn, from, to);
+  }
+
+  public static SelfSignedCaCertificate create(KeyPair keyPair, String fqdn, Date from, Date to)
+      throws Exception {
+    return new SelfSignedCaCertificate(keyPair.getPrivate(), createCaCert(keyPair, fqdn, from, to));
+  }
+
+  static KeyPairGenerator createKeyPairGenerator() {
+    try {
+      KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA", PROVIDER);
+      keyGen.initialize(2048, new SecureRandom());
+      return keyGen;
+    } catch (Exception e) {
+      throw new RuntimeException(e);
+    }
+  }
+
+  /** Returns a self-signed Certificate Authority (CA) certificate. */
+  static X509Certificate createCaCert(KeyPair keyPair, String fqdn, Date from, Date to)
+      throws Exception {
+    X500Name owner = new X500Name("CN=" + fqdn);
+    ContentSigner signer =
+        new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(keyPair.getPrivate());
+    X509v3CertificateBuilder builder =
+        new JcaX509v3CertificateBuilder(
+            owner, new BigInteger(64, RANDOM), from, to, owner, keyPair.getPublic());
+
+    // Mark cert as CA by adding basicConstraint with cA=true to the builder
+    BasicConstraints basicConstraints = new BasicConstraints(true);
+    builder.addExtension(new ASN1ObjectIdentifier("2.5.29.19"), true, basicConstraints);
+
+    X509CertificateHolder certHolder = builder.build(signer);
+    return new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(certHolder);
+  }
+}

networking/src/test/java/google/registry/networking/handler/SslClientInitializerTest.java

@@ -21,6 +21,7 @@ import static google.registry.networking.handler.SslInitializerTestUtils.signKey
 import static google.registry.networking.handler.SslInitializerTestUtils.verifySslExcpetion;
 
 import com.google.common.collect.ImmutableList;
+import google.registry.networking.util.SelfSignedCaCertificate;
 import io.netty.channel.Channel;
 import io.netty.channel.ChannelHandler;
 import io.netty.channel.ChannelPipeline;
@@ -35,7 +36,6 @@ import io.netty.handler.ssl.SslContextBuilder;
 import io.netty.handler.ssl.SslHandler;
 import io.netty.handler.ssl.SslProvider;
 import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
 import java.security.KeyPair;
 import java.security.PrivateKey;
 import java.security.cert.CertPathBuilderException;
@@ -153,7 +153,7 @@ public class SslClientInitializerTest {
 
   @Test
   public void testFailure_defaultTrustManager_rejectSelfSignedCert() throws Exception {
-    SelfSignedCertificate ssc = new SelfSignedCertificate(SSL_HOST);
+    SelfSignedCaCertificate ssc = SelfSignedCaCertificate.create(SSL_HOST);
     LocalAddress localAddress =
         new LocalAddress("DEFAULT_TRUST_MANAGER_REJECT_SELF_SIGNED_CERT_" + sslProvider);
     nettyRule.setUpServer(localAddress, getServerHandler(false, ssc.key(), ssc.cert()));
@@ -177,7 +177,7 @@ public class SslClientInitializerTest {
     KeyPair keyPair = getKeyPair();
 
     // Generate a self signed certificate, and use it to sign the key pair.
-    SelfSignedCertificate ssc = new SelfSignedCertificate();
+    SelfSignedCaCertificate ssc = SelfSignedCaCertificate.create();
     X509Certificate cert = signKeyPair(ssc, keyPair, SSL_HOST);
 
     // Set up the server to use the signed cert and private key to perform handshake;
@@ -206,7 +206,7 @@ public class SslClientInitializerTest {
     KeyPair keyPair = getKeyPair();
 
     // Generate a self signed certificate, and use it to sign the key pair.
-    SelfSignedCertificate ssc = new SelfSignedCertificate();
+    SelfSignedCaCertificate ssc = SelfSignedCaCertificate.create();
     X509Certificate cert =
         signKeyPair(
             ssc,
@@ -240,7 +240,7 @@ public class SslClientInitializerTest {
     KeyPair keyPair = getKeyPair();
 
     // Generate a self signed certificate, and use it to sign the key pair.
-    SelfSignedCertificate ssc = new SelfSignedCertificate();
+    SelfSignedCaCertificate ssc = SelfSignedCaCertificate.create();
     X509Certificate cert =
         signKeyPair(
             ssc,
@@ -272,8 +272,8 @@ public class SslClientInitializerTest {
         new LocalAddress(
             "CUSTOM_TRUST_MANAGER_ACCEPT_SELF_SIGNED_CERT_CLIENT_CERT_REQUIRED_" + sslProvider);
 
-    SelfSignedCertificate serverSsc = new SelfSignedCertificate(SSL_HOST);
-    SelfSignedCertificate clientSsc = new SelfSignedCertificate();
+    SelfSignedCaCertificate serverSsc = SelfSignedCaCertificate.create(SSL_HOST);
+    SelfSignedCaCertificate clientSsc = SelfSignedCaCertificate.create();
 
     // Set up the server to require client certificate.
     nettyRule.setUpServer(localAddress, getServerHandler(true, serverSsc.key(), serverSsc.cert()));
@@ -311,7 +311,7 @@ public class SslClientInitializerTest {
     KeyPair keyPair = getKeyPair();
 
     // Generate a self signed certificate, and use it to sign the key pair.
-    SelfSignedCertificate ssc = new SelfSignedCertificate();
+    SelfSignedCaCertificate ssc = SelfSignedCaCertificate.create();
     X509Certificate cert = signKeyPair(ssc, keyPair, "wrong.com");
 
     // Set up the server to use the signed cert and private key to perform handshake;

networking/src/test/java/google/registry/networking/handler/SslInitializerTestUtils.java

@@ -18,15 +18,14 @@ import static com.google.common.truth.Truth.assertThat;
 import static org.junit.Assert.assertThrows;
 
 import com.google.common.base.Throwables;
+import google.registry.networking.util.SelfSignedCaCertificate;
 import io.netty.channel.Channel;
 import io.netty.channel.ChannelFuture;
 import io.netty.handler.ssl.SslHandler;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
 import java.math.BigInteger;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.SecureRandom;
-import java.security.Security;
 import java.security.cert.X509Certificate;
 import java.time.Duration;
 import java.time.Instant;
@@ -34,17 +33,13 @@ import java.util.Date;
 import java.util.concurrent.ExecutionException;
 import javax.net.ssl.SSLSession;
 import org.bouncycastle.asn1.x500.X500Name;
-import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
-import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.X509v3CertificateBuilder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
-import org.bouncycastle.crypto.util.PrivateKeyFactory;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.operator.ContentSigner;
-import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
-import org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder;
-import org.bouncycastle.operator.bc.BcRSAContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
 
 /**
  * Utility class that provides methods used by {@link SslClientInitializerTest} and {@link
@@ -52,16 +47,23 @@ import org.bouncycastle.operator.bc.BcRSAContentSignerBuilder;
  */
 public final class SslInitializerTestUtils {
 
-  static {
-    Security.addProvider(new BouncyCastleProvider());
-  }
+  private static final BouncyCastleProvider PROVIDER = new BouncyCastleProvider();
+  private static final KeyPairGenerator KEY_PAIR_GENERATOR = getKeyPairGenerator();
 
   private SslInitializerTestUtils() {}
 
+  private static KeyPairGenerator getKeyPairGenerator() {
+    try {
+      KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", PROVIDER);
+      keyPairGenerator.initialize(2048, new SecureRandom());
+      return keyPairGenerator;
+    } catch (Exception e) {
+      throw new RuntimeException(e);
+    }
+  }
+
   public static KeyPair getKeyPair() throws Exception {
-    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", "BC");
-    keyPairGenerator.initialize(2048, new SecureRandom());
-    return keyPairGenerator.generateKeyPair();
+    return KEY_PAIR_GENERATOR.generateKeyPair();
   }
 
   /**
@@ -71,26 +73,20 @@ public final class SslInitializerTestUtils {
    * @return signed public key (of the key pair) certificate
    */
   public static X509Certificate signKeyPair(
-      SelfSignedCertificate ssc, KeyPair keyPair, String hostname, Date from, Date to)
+      SelfSignedCaCertificate ssc, KeyPair keyPair, String hostname, Date from, Date to)
       throws Exception {
     X500Name subjectDnName = new X500Name("CN=" + hostname);
     BigInteger serialNumber = BigInteger.valueOf(System.currentTimeMillis());
     X500Name issuerDnName = new X500Name(ssc.cert().getIssuerDN().getName());
-    SubjectPublicKeyInfo subPubKeyInfo =
-        SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
-    AlgorithmIdentifier sigAlgId =
-        new DefaultSignatureAlgorithmIdentifierFinder().find("SHA256WithRSAEncryption");
-    AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
-
-    ContentSigner sigGen =
-        new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
-            .build(PrivateKeyFactory.createKey(ssc.key().getEncoded()));
+    ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(ssc.key());
     X509v3CertificateBuilder v3CertGen =
-        new X509v3CertificateBuilder(
-            issuerDnName, serialNumber, from, to, subjectDnName, subPubKeyInfo);
+        new JcaX509v3CertificateBuilder(
+            issuerDnName, serialNumber, from, to, subjectDnName, keyPair.getPublic());
 
     X509CertificateHolder certificateHolder = v3CertGen.build(sigGen);
-    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certificateHolder);
+    return new JcaX509CertificateConverter()
+        .setProvider(PROVIDER)
+        .getCertificate(certificateHolder);
   }
 
   /**
@@ -100,7 +96,7 @@ public final class SslInitializerTestUtils {
    * @return signed public key (of the key pair) certificate
    */
   public static X509Certificate signKeyPair(
-      SelfSignedCertificate ssc, KeyPair keyPair, String hostname) throws Exception {
+      SelfSignedCaCertificate ssc, KeyPair keyPair, String hostname) throws Exception {
     return signKeyPair(
         ssc,
         keyPair,

networking/src/test/java/google/registry/networking/handler/SslServerInitializerTest.java

@@ -23,6 +23,7 @@ import static google.registry.networking.handler.SslServerInitializer.CLIENT_CER
 
 import com.google.common.base.Suppliers;
 import com.google.common.collect.ImmutableList;
+import google.registry.networking.util.SelfSignedCaCertificate;
 import io.netty.channel.ChannelHandler;
 import io.netty.channel.ChannelInitializer;
 import io.netty.channel.ChannelPipeline;
@@ -33,7 +34,6 @@ import io.netty.handler.ssl.OpenSsl;
 import io.netty.handler.ssl.SslContextBuilder;
 import io.netty.handler.ssl.SslHandler;
 import io.netty.handler.ssl.SslProvider;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
 import java.security.KeyPair;
 import java.security.PrivateKey;
 import java.security.cert.CertificateException;
@@ -127,7 +127,7 @@ public class SslServerInitializerTest {
 
   @Test
   public void testSuccess_swappedInitializerWithSslHandler() throws Exception {
-    SelfSignedCertificate ssc = new SelfSignedCertificate(SSL_HOST);
+    SelfSignedCaCertificate ssc = SelfSignedCaCertificate.create(SSL_HOST);
     SslServerInitializer<EmbeddedChannel> sslServerInitializer =
         new SslServerInitializer<>(
             true,
@@ -147,12 +147,12 @@ public class SslServerInitializerTest {
 
   @Test
   public void testSuccess_trustAnyClientCert() throws Exception {
-    SelfSignedCertificate serverSsc = new SelfSignedCertificate(SSL_HOST);
+    SelfSignedCaCertificate serverSsc = SelfSignedCaCertificate.create(SSL_HOST);
     LocalAddress localAddress = new LocalAddress("TRUST_ANY_CLIENT_CERT_" + sslProvider);
 
     nettyRule.setUpServer(
         localAddress, getServerHandler(true, false, serverSsc.key(), serverSsc.cert()));
-    SelfSignedCertificate clientSsc = new SelfSignedCertificate();
+    SelfSignedCaCertificate clientSsc = SelfSignedCaCertificate.create();
     nettyRule.setUpClient(
         localAddress, getClientHandler(serverSsc.cert(), clientSsc.key(), clientSsc.cert()));
 
@@ -168,13 +168,13 @@ public class SslServerInitializerTest {
 
   @Test
   public void testFailure_clientCertExpired() throws Exception {
-    SelfSignedCertificate serverSsc = new SelfSignedCertificate(SSL_HOST);
+    SelfSignedCaCertificate serverSsc = SelfSignedCaCertificate.create(SSL_HOST);
     LocalAddress localAddress = new LocalAddress("CLIENT_CERT_EXPIRED_" + sslProvider);
 
     nettyRule.setUpServer(
         localAddress, getServerHandler(true, true, serverSsc.key(), serverSsc.cert()));
-    SelfSignedCertificate clientSsc =
-        new SelfSignedCertificate(
+    SelfSignedCaCertificate clientSsc =
+        SelfSignedCaCertificate.create(
             "CLIENT",
             Date.from(Instant.now().minus(Duration.ofDays(2))),
             Date.from(Instant.now().minus(Duration.ofDays(1))));
@@ -189,13 +189,13 @@ public class SslServerInitializerTest {
 
   @Test
   public void testFailure_clientCertNotYetValid() throws Exception {
-    SelfSignedCertificate serverSsc = new SelfSignedCertificate(SSL_HOST);
+    SelfSignedCaCertificate serverSsc = SelfSignedCaCertificate.create(SSL_HOST);
     LocalAddress localAddress = new LocalAddress("CLIENT_CERT_EXPIRED_" + sslProvider);
 
     nettyRule.setUpServer(
         localAddress, getServerHandler(true, true, serverSsc.key(), serverSsc.cert()));
-    SelfSignedCertificate clientSsc =
-        new SelfSignedCertificate(
+    SelfSignedCaCertificate clientSsc =
+        SelfSignedCaCertificate.create(
             "CLIENT",
             Date.from(Instant.now().plus(Duration.ofDays(1))),
             Date.from(Instant.now().plus(Duration.ofDays(2))));
@@ -210,7 +210,7 @@ public class SslServerInitializerTest {
 
   @Test
   public void testSuccess_doesNotRequireClientCert() throws Exception {
-    SelfSignedCertificate serverSsc = new SelfSignedCertificate(SSL_HOST);
+    SelfSignedCaCertificate serverSsc = SelfSignedCaCertificate.create(SSL_HOST);
     LocalAddress localAddress = new LocalAddress("DOES_NOT_REQUIRE_CLIENT_CERT_" + sslProvider);
 
     nettyRule.setUpServer(
@@ -230,7 +230,7 @@ public class SslServerInitializerTest {
   @Test
   public void testSuccess_CertSignedByOtherCA() throws Exception {
     // The self-signed cert of the CA.
-    SelfSignedCertificate caSsc = new SelfSignedCertificate();
+    SelfSignedCaCertificate caSsc = SelfSignedCaCertificate.create();
     KeyPair keyPair = getKeyPair();
     X509Certificate serverCert = signKeyPair(caSsc, keyPair, SSL_HOST);
     LocalAddress localAddress = new LocalAddress("CERT_SIGNED_BY_OTHER_CA_" + sslProvider);
@@ -244,7 +244,7 @@ public class SslServerInitializerTest {
             // Serving both the server cert, and the CA cert
             serverCert,
             caSsc.cert()));
-    SelfSignedCertificate clientSsc = new SelfSignedCertificate();
+    SelfSignedCaCertificate clientSsc = SelfSignedCaCertificate.create();
     nettyRule.setUpClient(
         localAddress,
         getClientHandler(
@@ -263,7 +263,7 @@ public class SslServerInitializerTest {
 
   @Test
   public void testFailure_requireClientCertificate() throws Exception {
-    SelfSignedCertificate serverSsc = new SelfSignedCertificate(SSL_HOST);
+    SelfSignedCaCertificate serverSsc = SelfSignedCaCertificate.create(SSL_HOST);
     LocalAddress localAddress = new LocalAddress("REQUIRE_CLIENT_CERT_" + sslProvider);
 
     nettyRule.setUpServer(
@@ -285,12 +285,12 @@ public class SslServerInitializerTest {
 
   @Test
   public void testFailure_wrongHostnameInCertificate() throws Exception {
-    SelfSignedCertificate serverSsc = new SelfSignedCertificate("wrong.com");
+    SelfSignedCaCertificate serverSsc = SelfSignedCaCertificate.create("wrong.com");
     LocalAddress localAddress = new LocalAddress("WRONG_HOSTNAME_" + sslProvider);
 
     nettyRule.setUpServer(
         localAddress, getServerHandler(true, false, serverSsc.key(), serverSsc.cert()));
-    SelfSignedCertificate clientSsc = new SelfSignedCertificate();
+    SelfSignedCaCertificate clientSsc = SelfSignedCaCertificate.create();
     nettyRule.setUpClient(
         localAddress, getClientHandler(serverSsc.cert(), clientSsc.key(), clientSsc.cert()));
 

networking/src/test/java/google/registry/networking/module/CertificateSupplierModuleTest.java

@@ -26,7 +26,7 @@ import dagger.Component;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.networking.module.CertificateSupplierModule.Mode;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
+import google.registry.networking.util.SelfSignedCaCertificate;
 import java.io.ByteArrayOutputStream;
 import java.io.OutputStreamWriter;
 import java.security.KeyPair;
@@ -47,7 +47,7 @@ import org.junit.runners.JUnit4;
 @RunWith(JUnit4.class)
 public class CertificateSupplierModuleTest {
 
-  private SelfSignedCertificate ssc;
+  private SelfSignedCaCertificate ssc;
   private PrivateKey key;
   private Certificate cert;
   private TestComponent component;
@@ -62,7 +62,7 @@ public class CertificateSupplierModuleTest {
 
   @Before
   public void setUp() throws Exception {
-    ssc = new SelfSignedCertificate();
+    ssc = SelfSignedCaCertificate.create();
     KeyPair keyPair = getKeyPair();
     key = keyPair.getPrivate();
     cert = signKeyPair(ssc, keyPair, "example.tld");

proxy/src/test/java/google/registry/proxy/EppProtocolModuleTest.java

@@ -23,6 +23,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.junit.Assert.assertThrows;
 
 import com.google.common.base.Throwables;
+import google.registry.networking.util.SelfSignedCaCertificate;
 import google.registry.proxy.handler.HttpsRelayServiceHandler.NonOkHttpResponseException;
 import google.registry.testing.FakeClock;
 import io.netty.buffer.ByteBuf;
@@ -34,7 +35,6 @@ import io.netty.handler.codec.http.FullHttpResponse;
 import io.netty.handler.codec.http.HttpResponseStatus;
 import io.netty.handler.codec.http.cookie.Cookie;
 import io.netty.handler.codec.http.cookie.DefaultCookie;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
 import io.netty.util.concurrent.Promise;
 import java.security.cert.X509Certificate;
 import org.junit.Before;
@@ -123,7 +123,7 @@ public class EppProtocolModuleTest extends ProtocolModuleTest {
   @Before
   public void setUp() throws Exception {
     testComponent = makeTestComponent(new FakeClock());
-    certificate = new SelfSignedCertificate().cert();
+    certificate = SelfSignedCaCertificate.create().cert();
     initializeChannel(
         ch -> {
           ch.attr(REMOTE_ADDRESS_KEY).set(CLIENT_ADDRESS);

proxy/src/test/java/google/registry/proxy/handler/EppServiceHandlerTest.java

@@ -27,6 +27,7 @@ import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 
 import com.google.common.base.Throwables;
+import google.registry.networking.util.SelfSignedCaCertificate;
 import google.registry.proxy.TestUtils;
 import google.registry.proxy.handler.HttpsRelayServiceHandler.NonOkHttpResponseException;
 import google.registry.proxy.metric.FrontendMetrics;
@@ -41,7 +42,6 @@ import io.netty.handler.codec.http.HttpResponse;
 import io.netty.handler.codec.http.HttpResponseStatus;
 import io.netty.handler.codec.http.cookie.Cookie;
 import io.netty.handler.codec.http.cookie.DefaultCookie;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
 import io.netty.util.concurrent.Promise;
 import java.security.cert.X509Certificate;
 import org.junit.Before;
@@ -114,7 +114,7 @@ public class EppServiceHandlerTest {
 
   @Before
   public void setUp() throws Exception {
-    clientCertificate = new SelfSignedCertificate().cert();
+    clientCertificate = SelfSignedCaCertificate.create().cert();
     channel = setUpNewChannel(eppServiceHandler);
   }
 
@@ -179,7 +179,7 @@ public class EppServiceHandlerTest {
             HELLO.getBytes(UTF_8),
             metrics);
     EmbeddedChannel channel2 = setUpNewChannel(eppServiceHandler2);
-    X509Certificate clientCertificate2 = new SelfSignedCertificate().cert();
+    X509Certificate clientCertificate2 = SelfSignedCaCertificate.create().cert();
     setHandshakeSuccess(channel2, clientCertificate2);
     String certHash2 = getCertificateHash(clientCertificate2);
 

release/build_nomulus_for_env.sh

@@ -29,6 +29,13 @@ environment="$1"
 dest="$2"
 gcs_prefix="storage.googleapis.com/domain-registry-maven-repository"
 
+# Let Gradle put its caches (dependency cache and build cache) in the source
+# tree. This allows sharing of the caches between steps in a Cloud Build
+# task. (See ./cloudbuild-nomulus.yaml, which calls this script in several
+# steps). If left at their default location, the caches will be lost after
+# each step.
+export GRADLE_USER_HOME="./cloudbuild-caches"
+
 if [ "${environment}" == tool ]
 then
   mkdir -p "${dest}"