Update Gradle wrapper to 5.6 (#232)

* Update Gradle wrapper to 5.6

* Upgrade shadowJar to 5.1 and increase JVM heap size

* Use Gradle binary on GCS

.gcloudignore

@@ -1,8 +1,9 @@
-docs/**
-python/**
-bazel-*/**
-gradle/**/build/**
-gradle/**/WEB-INF/**
-gradle/.*/**
+python/
+**/build/
+**/out/
+.*/
 repos/**
-**/.idea/**
+**/.idea/
+*.jar
+!third_party/**/*.jar
+!/gradle/wrapper/**/*.jar

.gitignore

@@ -74,6 +74,17 @@ local.properties
 # Auto-generated java files
 autogenerated/
 
+# IDEA
+nomulus.iml
+nomulus.ipr
+nomulus.iws
+
+# VScode
+.vscode
+
+# Javascript output
+**/out/*
+
 ######################################################################
 # Python Ignores
 
@@ -83,11 +94,15 @@ autogenerated/
 # Gradle Ignores
 
 # We don't want to ignore the gradle jar files
-!/gradle/gradle/wrapper/**/*.jar
+!/gradle/wrapper/**/*.jar
 .gradle/
-/gradle/.gradle
-/gradle/**/WEB-INF
-/gradle/**/build
-/gradle/node_modules/**
-!/gradle/node_modules/soyutils_usegoog.js
+**/build
+node_modules/**
+!node_modules/soyutils_usegoog.js
 /repos/
+
+# Compiled JS/CSS code
+core/**/registrar_bin*.js
+core/**/registrar_dbg*.js
+core/**/registrar_bin*.css
+core/**/registrar_dbg*.css

.lgtm.yml

@@ -0,0 +1,4 @@
+extraction:
+  java:
+    prepare:
+      packages: "npm"

.travis.yml

@@ -1,58 +0,0 @@
-# Copyright 2018 The Nomulus Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-# Collecting report files from a travis build to GCS requires setting the
-# "CREDZ" and "REPORT_GCS_BUCKET" environment variables in your travis
-# repository.
-#
-# The report destination can be any GCS path (e.g. "gcs://bucket-name/path").
-# You'll want to select "Display value in build log", otherwise travis will
-# hide the bucket name in the URL that is displayed.
-#
-# The CREDZ variable should be the contents of a json credentials file for
-# a service account with write access to the bucket, escaped for bash shell
-# usage (usually just wrapping it in single quotes should suffice).
-
-language: java
-install: true
-jdk:
-  # Our builds fail against Oracle Java for reasons yet unknown.
-  - openjdk8
-
-# Caching options suggested by a random article.
-before_cache:
-  - rm -f $HOME/.gradle/caches/modules-2/modules-2.lock
-  - rm -f $HOME/.gradle/caches/*/plugin-resolution/
-
-cache:
-  directories:
-    - $HOME/.gradle/caches/
-    - $HOME/.gradle/wrapper/
-
-# WebDriver tests need Chrome and ChromeDriver provisioned by the docker image
-services:
-  - docker
-
-env:
-  # Disable fancy status information (looks bad on travis and exceeds logfile
-  # quota)
-  TERM=dumb
-
-# Specialize gradle build to use an up-to-date gradle and the /gradle
-# directory.
-# The "travis_wait 45" lets our build spend up to 45 minutes without writing
-# output, instead of the default 10.
-# See notes on the CREDZ and REPORT_GCS_BUCKET environment variable in the
-# comments at the top of the file.
-script: cd gradle && echo "$CREDZ" >credz.json && chmod 755 ./gradlew && travis_wait 45 ./gradlew build --continue -P uploaderDestination="$REPORT_GCS_DESTINATION" -P uploaderCredentialsFile=credz.json -P uploaderMultithreadedUpload=yes -P mavenUrl=https://storage.googleapis.com/domain-registry-maven-repository/maven -P pluginsUrl=https://storage.googleapis.com/domain-registry-maven-repository/plugins

CONTRIBUTORS

@@ -32,3 +32,5 @@ Hans Ridder <hans.ridder@gmail.com>
 Justin Graham <justin.af.graham@gmail.com>
 Guy Bensky <guyben@google.com>
 Weimin Yu <weiminyu@google.com>
+Shicong Huang <shicong@google.com>
+Gustav Brodman <gbrodman@google.com>

LICENSE

@@ -1,4 +1,3 @@
-
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/

README.md

@@ -1,8 +1,8 @@
 # Nomulus
 
-| Bazel | Gradle |
-|-------|--------|
-|![Build Status](https://storage.googleapis.com/domain-registry-github-build-status/github-ci-status.png)|[![Build Status](https://travis-ci.org/google/nomulus.svg?branch=master)](https://travis-ci.org/google/nomulus)|
+| Internal Build | FOSS Build | LGTM | License | Code Search |
+|----------------|------------|------|---------|-------------|
+|[![Build Status for Google Registry internal build](https://storage.googleapis.com/domain-registry-kokoro/internal/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/internal/index.html)|[![Build Status for the open source build](https://storage.googleapis.com/domain-registry-kokoro/foss/build.svg)](https://storage.googleapis.com/domain-registry-kokoro/foss/index.html)|[![Total alerts](https://img.shields.io/lgtm/alerts/g/google/nomulus.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/google/nomulus/alerts/)|[![License for this repo](https://img.shields.io/github/license/google/nomulus.svg)](https://github.com/google/nomulus/blob/master/LICENSE)|[![Link to Source Graph](https://github.com/sourcegraph/sourcegraph/blob/master/ui/assets/img/sourcegraph-logo.svg)](https://sourcegraph.com/github.com/google/nomulus)|
 
 ![Nomulus logo](./nomulus-logo.png)
 
@@ -30,8 +30,8 @@ running system:
 
 *   [Install
     guide](https://github.com/google/nomulus/blob/master/docs/install.md)
-*   View the source code in
-    [java/google/registry/](https://github.com/google/nomulus/tree/master/java/google/registry)
+*   View the source code for the [GAE app](https://github.com/google/nomulus/tree/master/core/src/main/java/google/registry)
+    and for the [GKE proxy](https://github.com/google/nomulus/tree/master/proxy/src/main/java/google/registry)
 *   [Other docs](https://github.com/google/nomulus/tree/master/docs)
 *   [Javadoc](https://nomulus.foo/javadoc/latest/)
 *   [Nomulus discussion

WORKSPACE

@@ -1,56 +0,0 @@
-workspace(name = "domain_registry")
-
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-# https://github.com/bazelbuild/rules_closure/releases/tag/0.8.0
-http_archive(
-    name = "io_bazel_rules_closure",
-    sha256 = "0e6de40666f2ebb2b30dc0339745a274d9999334a249b05a3b1f46462e489adf",
-    strip_prefix = "rules_closure-87d24b1df8b62405de8dd059cb604fd9d4b1e395",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_closure/archive/87d24b1df8b62405de8dd059cb604fd9d4b1e395.tar.gz",
-        "https://github.com/bazelbuild/rules_closure/archive/87d24b1df8b62405de8dd059cb604fd9d4b1e395.tar.gz",
-    ],
-)
-load("@io_bazel_rules_closure//closure:defs.bzl", "closure_repositories")
-
-closure_repositories(
-    omit_com_google_auto_factory = True,
-    omit_com_google_protobuf = True,
-    omit_com_google_code_findbugs_jsr305 = True,
-    omit_com_google_guava = True,
-    omit_com_ibm_icu_icu4j = True,
-    omit_javax_inject = True,
-    omit_org_json = True,
-)
-
-load("//java/google/registry:repositories.bzl", "domain_registry_repositories")
-
-domain_registry_repositories()
-
-# Setup docker bazel rules
-http_archive(
-    name = "io_bazel_rules_docker",
-    sha256 = "aed1c249d4ec8f703edddf35cbe9dfaca0b5f5ea6e4cd9e83e99f3b0d1136c3d",
-    strip_prefix = "rules_docker-0.7.0",
-    urls = ["https://github.com/bazelbuild/rules_docker/archive/v0.7.0.tar.gz"],
-)
-
-load(
-    "@io_bazel_rules_docker//repositories:repositories.bzl",
-    container_repositories = "repositories",
-)
-container_repositories()
-
-load(
-    "@io_bazel_rules_docker//container:container.bzl",
-    "container_pull",
-)
-
-container_pull(
-  name = "java_base",
-  registry = "gcr.io",
-  repository = "distroless/java",
-  # 'tag' is also supported, but digest is encouraged for reproducibility.
-  digest = "sha256:84a63da5da6aba0f021213872de21a4f9829e4bd2801aef051cf40b6f8952e68",
-)

appengine_war.gradle

@@ -0,0 +1,81 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+apply from: "${rootDir.path}/projects.gradle"
+apply plugin: 'war'
+
+def environment = rootProject.environment
+def gcpProject = rootProject.gcpProject
+
+// Set this directory before applying the appengine plugin so that the
+// plugin will recognize this as an app-engine standard app (and also
+// obtains the appengine-web.xml from the correct location)
+project.convention.plugins['war'].webAppDirName =
+        "../../core/src/main/java/google/registry/env/${environment}/${project.name}"
+
+apply plugin: 'com.google.cloud.tools.appengine'
+
+// Get the web.xml file for the service.
+war {
+    webInf {
+        from "../../core/src/main/java/google/registry/env/common/${project.name}/WEB-INF"
+    }
+}
+
+def coreResourcesDir = "${rootDir}/core/build/resources/main"
+war {
+    from("${coreResourcesDir}/google/registry/ui/html") {
+        include "*.html"
+    }
+}
+
+if (project.path == ":services:default") {
+    war {
+        from("${coreResourcesDir}/google/registry/ui") {
+            include "registrar_bin.js"
+            if (environment != "production") {
+                include "registrar_bin.js.map"
+            }
+            into("assets/js")
+        }
+        from("${coreResourcesDir}/google/registry/ui/css") {
+            include "registrar*"
+            into("assets/css")
+        }
+        from("${coreResourcesDir}/google/registry/ui/assets/images") {
+            include "**/*"
+            into("assets/images")
+        }
+    }
+}
+
+appengine {
+    deploy {
+        // appengineDeployAll task requires the version to be set. So,
+        // this config lets gcloud select a version name when deploying
+        // to alpha or sandbox from our workstation.
+        if (!rootProject.prodOrSandboxEnv) {
+            version = 'GCLOUD_CONFIG'
+        }
+        projectId = gcpProject
+    }
+}
+
+dependencies {
+    compile project(':core')
+}
+
+rootProject.deploy.dependsOn appengineDeployAll
+rootProject.stage.dependsOn appengineStage
+appengineDeployAll.dependsOn rootProject.verifyDeployment

build.gradle

@@ -0,0 +1,335 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import org.gradle.api.tasks.testing.logging.TestExceptionFormat
+import org.gradle.api.tasks.testing.logging.TestLogEvent
+
+buildscript {
+  if (rootProject.enableDependencyLocking.toBoolean()) {
+    // Lock buildscript dependencies.
+    configurations.classpath {
+      resolutionStrategy.activateDependencyLocking()
+    }
+  }
+
+  dependencies {
+    classpath 'com.google.cloud.tools:appengine-gradle-plugin:2.0.1'
+    classpath "net.ltgt.gradle:gradle-errorprone-plugin:0.6.1"
+    classpath 'org.sonatype.aether:aether-api:1.13.1'
+    classpath 'org.sonatype.aether:aether-impl:1.13.1'
+  }
+}
+
+plugins {
+  // Java static analysis plugins. Keep versions consistent with
+  // ./buildSrc/build.gradle
+  id 'nebula.lint' version '10.4.2'
+  // TODO(weiminyu): consider remove net.ltgt.apt. Gradle 5.2+
+  //  has similar functionalities.
+  id 'net.ltgt.apt' version '0.19' apply false
+  id 'net.ltgt.errorprone' version '0.6.1'
+  id 'checkstyle'
+  id 'com.github.johnrengelman.shadow' version '5.1.0'
+
+  // NodeJs plugin
+  id "com.moowork.node" version "1.2.0"
+
+  id 'idea'
+  id 'com.diffplug.gradle.spotless' version '3.18.0'
+
+  id 'jacoco'
+}
+
+wrapper {
+  distributionType = Wrapper.DistributionType.ALL
+}
+
+apply plugin: google.registry.gradle.plugin.ReportUploaderPlugin
+
+reportUploader {
+  // Set the location where we want to upload the build results.
+  // e.g. -P uploaderDestination=gcs://domain-registry-alpha-build-result-test
+  //
+  // If not set - the upload will be skipped
+  destination = uploaderDestination
+
+  // The location of the file containing the OAuth2 Google Cloud credentials.
+  //
+  // The file can contain a Service Account key file in JSON format from the
+  // Google Developers Console or a stored user credential using the format
+  // supported by the Cloud SDK.
+  //
+  // If no file is given - the default credentials are used.
+  credentialsFile = uploaderCredentialsFile
+
+  // If set to 'yes', each file will be uploaded to GCS in a separate thread.
+  // This is MUCH faster.
+  multithreadedUpload = uploaderMultithreadedUpload
+}
+
+apply from: 'dependencies.gradle'
+
+apply from: 'dependency_lic.gradle'
+
+// Custom task to run checkLicense in buildSrc, which is not triggered
+// by root project tasks. A shell task is used because buildSrc tasks
+// cannot be referenced in the same way as tasks from a regular included
+// build.
+task checkBuildSrcLicense(type:Exec) {
+  workingDir "${rootDir}/buildSrc"
+  commandLine '../gradlew', 'checkLicense'
+}
+tasks.checkLicense.dependsOn(tasks.checkBuildSrcLicense)
+tasks.build.dependsOn(tasks.checkLicense)
+
+// Provide defaults for all of the project properties.
+
+// showAllOutput: boolean.  If true, dump all test output during the build.
+if (!project.hasProperty('showAllOutput')) {
+  ext.showAllOutput = 'false'
+}
+
+// Only do linting if the build is successful.
+gradleLint.autoLintAfterFailure = false
+
+// Paths to main and test sources.
+ext.projectRootDir = "${rootDir}"
+
+// Tasks to deploy/stage all App Engine services
+task deploy {
+  group = 'deployment'
+  description = 'Deploys all services to App Engine.'
+}
+
+task verifyDeployment {
+  group = 'deployment'
+  description = 'Ensure that one cannot deploy to production or sandbox.'
+  doFirst {
+    if (rootProject.prodOrSandboxEnv) {
+      throw new GradleException("Cannot deploy to production or sandbox.");
+    }
+  }
+}
+
+task stage {
+  group = 'deployment'
+  description = 'Generates application directories for all services.'
+}
+
+allprojects {
+  // Skip no-op project
+  if (project.name == 'services') return
+
+  repositories {
+    if (rootProject.mavenUrl) {
+      maven {
+        println "Java dependencies: Using repo $pluginsUrl..."
+        url rootProject.mavenUrl
+      }
+    } else {
+      println "Java dependencies: Using Maven Central..."
+      mavenCentral()
+    }
+  }
+}
+
+task runPresubmits(type: Exec) {
+  executable '/usr/bin/python'
+  args('config/presubmits.py')
+}
+
+subprojects {
+  // Skip no-op project
+  if (project.name == 'services') return
+
+  ext.createUberJar = { taskName, binaryName, mainClass ->
+    project.tasks.create(
+      taskName, com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar) {
+      mergeServiceFiles()
+      baseName = binaryName
+      manifest {
+        attributes 'Main-Class': mainClass
+      }
+      zip64 = true
+      classifier = ''
+      archiveVersion = ''
+      configurations = [project.configurations.runtimeClasspath]
+      from project.sourceSets.main.output
+      // Excludes signature files that accompany some dependency jars, like
+      // bonuncycastle. If they are present, only classes from those signed jars are
+      // made available to the class loader.
+      // see https://discuss.gradle.org/t/signing-a-custom-gradle-plugin-thats-downloaded-by-the-build-system-from-github/1365
+      exclude "META-INF/*.SF", "META-INF/*.DSA", "META-INF/*.RSA"
+    }
+  }
+
+  if (rootProject.enableDependencyLocking.toBoolean()) {
+    buildscript {
+      // Lock buildscript dependencies.
+      configurations.classpath {
+        resolutionStrategy.activateDependencyLocking()
+      }
+    }
+    // Lock application dependencies except for the gradle-license-report
+    // plugin. See dependency_lic.gradle for more information.
+    configurations.findAll { it.name != 'dependencyLicenseReport' }.each {
+      it.resolutionStrategy.activateDependencyLocking()
+    }
+  }
+
+  def services = [':services:default',
+                  ':services:backend',
+                  ':services:tools',
+                  ':services:pubapi']
+
+  // Set up all of the deployment projects.
+  if (services.contains(project.path)) {
+
+    apply from: "${rootDir.path}/appengine_war.gradle"
+
+    // Return early, do not apply the settings below.
+    return
+  }
+
+  apply from: "${rootDir.path}/java_common.gradle"
+
+  if (project.name == 'third_party') return
+
+  project.tasks.test.dependsOn runPresubmits
+
+// Path to code generated with annotation processors. Note that this path is
+// chosen by the 'net.ltgt.apt' plugin, and may change if IDE-specific plugins
+// are applied, e.g., 'idea' or 'eclipse'
+  def aptGeneratedDir = "${project.buildDir}/generated/source/apt/main"
+  def aptGeneratedTestDir = "${project.buildDir}/generated/source/apt/test"
+
+  def commonlyExcludedResources = ['**/*.java', '**/BUILD']
+
+  project.ext.javaDir = "${project.projectDir}/src/main/java"
+  project.ext.javaTestDir = "${project.projectDir}/src/test/java"
+  project.ext.resourcesSourceDir = "${project.projectDir}/src/main/resources"
+
+  sourceSets {
+    main {
+      java {
+        srcDirs += aptGeneratedDir
+      }
+      resources {
+        srcDirs += project.ext.javaDir
+        exclude commonlyExcludedResources
+      }
+    }
+    test {
+      java {
+        srcDirs += aptGeneratedTestDir
+      }
+      resources {
+        srcDirs += project.ext.javaTestDir
+        exclude commonlyExcludedResources
+      }
+    }
+  }
+
+  if (['util', 'proxy', 'core', 'prober'].contains(project.name)) return
+
+  test {
+    testLogging.showStandardStreams = Boolean.parseBoolean(showAllOutput)
+  }
+
+  ext.relativePath = "google/registry/${project.name}"
+
+  sourceSets.each {
+    it.java {
+      include "${project.relativePath}/"
+    }
+    it.resources {
+      include "${project.relativePath}/"
+    }
+  }
+}
+
+// If "-P verboseTestOutput=true" is passed in, configure all subprojects to dump all of their
+// output and final test status (pass/fail, errors) for each test class.
+//
+// Note that we can't do this in the main subprojects section above because that's evaluated before
+// the subproject build files and the test tasks haven't been defined yet.  We have to do it from
+// the projectsEvaluted hook, which gets called after the subprojects are configured.
+if (verboseTestOutput.toBoolean()) {
+  gradle.projectsEvaluated({
+    subprojects {
+      tasks.withType(Test) {
+        testLogging {
+          events TestLogEvent.FAILED, TestLogEvent.PASSED, TestLogEvent.SKIPPED,
+              TestLogEvent.STANDARD_OUT, TestLogEvent.STANDARD_ERROR
+          exceptionFormat TestExceptionFormat.FULL
+          showExceptions true
+          showCauses true
+          showStackTraces true
+
+          afterSuite { desc, result ->
+            println "Results: ${result.resultType}, " +
+                "${result.successfulTestCount}/${result.testCount} tests " +
+                "passed, ${result.failedTestCount} failures.";
+          }
+        }
+      }
+    }
+  })
+}
+
+task checkDependenciesDotGradle {
+  def buildSrcDepsFile = File.createTempFile('buildSrc', 'deps')
+  buildSrcDepsFile.deleteOnExit()
+  dependsOn createGetBuildSrcDirectDepsTask(buildSrcDepsFile)
+
+  doLast {
+    Set<String> depsInUse = []
+    allprojects {
+      configurations.all {
+        it.dependencies.findAll { it.group != null }.each {
+          // Note: .toString() is required since GString should
+          // not be mixed with Java Strings.
+          depsInUse.add("${it.group}:${it.name}".toString())
+        }
+      }
+    }
+    if (buildSrcDepsFile.exists()) {
+      depsInUse.addAll(buildSrcDepsFile.readLines())
+    }
+    def unusedDeps =
+        rootProject.dependencyMap.keySet()
+            .findAll { !depsInUse.contains(it) }
+            .toSorted()
+
+    if (unusedDeps.isEmpty()) {
+      return
+    }
+    logger.error(
+        "Unused dependencies in dependencies.gradle:\n${unusedDeps.toListString()}")
+    throw new IllegalStateException(
+        "The dependencies.gradle file should only contain direct dependencies.")
+  }
+}
+tasks.build.dependsOn(tasks.checkDependenciesDotGradle)
+
+def createGetBuildSrcDirectDepsTask(outputFileName) {
+  return tasks
+      .create(
+          "getBuildSrcDeps_${java.util.UUID.randomUUID()}".toString(),
+          Exec) {
+    workingDir "${rootDir}/buildSrc"
+    commandLine '../gradlew', 'exportDenpendencies',
+                "-PdependencyExportFile=${outputFileName}"
+  }
+}

buildSrc/build.gradle

@@ -1,5 +1,19 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 buildscript {
-  if (rootProject.disableDependencyLocking.toBoolean() == false) {
+  if (project.enableDependencyLocking.toBoolean()) {
     // Lock buildscript dependencies.
     configurations.classpath {
       resolutionStrategy.activateDependencyLocking()
@@ -8,18 +22,17 @@ buildscript {
 }
 
 plugins {
-// Java static analysis plugins. Keep versions consistent with ../build.gradle
+  // Java static analysis plugins. Keep versions consistent with ../build.gradle
   id 'nebula.lint' version '10.4.2'
   // Config helper for annotation processors such as AutoValue and Dagger.
   // Ensures that source code is generated at an appropriate location.
   id 'net.ltgt.apt' version '0.19' apply false
   id 'net.ltgt.errorprone' version '0.6.1'
   id 'checkstyle'
-
   id 'com.diffplug.gradle.spotless' version '3.18.0'
 }
 
-if (rootProject.disableDependencyLocking.toBoolean() == false) {
+if (rootProject.enableDependencyLocking.toBoolean()) {
   // Lock application dependencies.
   dependencyLocking {
     lockAllConfigurations()
@@ -39,28 +52,21 @@ repositories {
 }
 
 apply from: '../dependencies.gradle'
+apply from: '../dependency_lic.gradle'
 apply from: '../java_common.gradle'
 
+sourceSets {
+  main {
+    java {
+      srcDirs += "${project.buildDir}/generated/source/apt/main"
+    }
+  }
+}
+
 checkstyle {
   configDir file('../config/checkstyle')
 }
 
-// To check or fix file formats, run the following commands from this directory:
-// - Check: ../gradlew spotlessCheck
-// - Format in place: ../gradlew spotlessApply
-spotless {
-  java {
-    googleJavaFormat('1.7')
-  }
-  format 'misc', {
-    target '**/*.gradle'
-
-    trimTrailingWhitespace()
-    indentWithSpaces(2)
-    endWithNewline()
-  }
-}
-
 dependencies {
   def deps = dependencyMap
   compile deps['com.google.auth:google-auth-library-credentials']
@@ -70,7 +76,6 @@ dependencies {
   compile deps['com.google.auto.value:auto-value-annotations']
   compile deps['com.google.cloud:google-cloud-storage']
   compile deps['org.apache.commons:commons-text']
-  compile deps['com.google.auth:google-auth-library-credentials']
   compile deps['com.google.template:soy']
   annotationProcessor deps['com.google.auto.value:auto-value']
   testCompile deps['com.google.truth:truth']
@@ -84,3 +89,21 @@ gradle.projectsEvaluated {
     options.compilerArgs << "-Xlint:unchecked"
   }
 }
+
+task exportDenpendencies {
+  def outputFileProperty = 'dependencyExportFile'
+  def output = project.hasProperty(outputFileProperty)
+      ? new PrintStream(
+          new File(project.getProperty(outputFileProperty)))
+      : System.out
+
+  doLast {
+    project.configurations.all {
+      it.dependencies.findAll {
+        it.group != null
+      }.each {
+        output.println("${it.group}:${it.name}")
+      }
+    }
+  }
+}

buildSrc/gradle.properties

@@ -0,0 +1 @@
+enableDependencyLocking=false

buildSrc/gradle/dependency-locks/compile.lockfile

@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.fasterxml.jackson.core:jackson-core:2.9.6
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.google.api-client:google-api-client:1.27.0
 com.google.api.grpc:proto-google-common-protos:1.12.0
 com.google.api.grpc:proto-google-iam-v1:0.12.0
@@ -11,8 +11,8 @@ com.google.api:api-common:1.7.0
 com.google.api:gax-httpjson:0.52.1
 com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
@@ -26,21 +26,21 @@ com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
-com.google.http-client:google-http-client-jackson2:1.27.0
-com.google.http-client:google-http-client:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
-io.grpc:grpc-context:1.12.0
-io.opencensus:opencensus-api:0.15.0
-io.opencensus:opencensus-contrib-http-util:0.15.0
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
@@ -48,8 +48,8 @@ javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-qual:2.5.2
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.json:json:20160212

buildSrc/gradle/dependency-locks/compileClasspath.lockfile

@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.fasterxml.jackson.core:jackson-core:2.9.6
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.google.api-client:google-api-client:1.27.0
 com.google.api.grpc:proto-google-common-protos:1.12.0
 com.google.api.grpc:proto-google-iam-v1:0.12.0
@@ -11,8 +11,8 @@ com.google.api:api-common:1.7.0
 com.google.api:gax-httpjson:0.52.1
 com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
@@ -26,21 +26,21 @@ com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
-com.google.http-client:google-http-client-jackson2:1.27.0
-com.google.http-client:google-http-client:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
-io.grpc:grpc-context:1.12.0
-io.opencensus:opencensus-api:0.15.0
-io.opencensus:opencensus-contrib-http-util:0.15.0
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
@@ -48,8 +48,8 @@ javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-qual:2.5.2
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.json:json:20160212

buildSrc/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.fasterxml.jackson.core:jackson-core:2.9.6
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.google.api-client:google-api-client:1.27.0
 com.google.api.grpc:proto-google-common-protos:1.12.0
 com.google.api.grpc:proto-google-iam-v1:0.12.0
@@ -11,8 +11,8 @@ com.google.api:api-common:1.7.0
 com.google.api:gax-httpjson:0.52.1
 com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
@@ -26,21 +26,21 @@ com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
-com.google.http-client:google-http-client-jackson2:1.27.0
-com.google.http-client:google-http-client:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
 com.ibm.icu:icu4j:57.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
-io.grpc:grpc-context:1.12.0
-io.opencensus:opencensus-api:0.15.0
-io.opencensus:opencensus-contrib-http-util:0.15.0
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
@@ -48,8 +48,8 @@ javax.validation:validation-api:1.0.0.GA
 joda-time:joda-time:2.9.2
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-qual:2.5.2
 org.codehaus.mojo:animal-sniffer-annotations:1.17
 org.json:json:20160212

buildSrc/gradle/dependency-locks/testCompile.lockfile

@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.fasterxml.jackson.core:jackson-core:2.9.6
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.google.api-client:google-api-client:1.27.0
 com.google.api.grpc:proto-google-common-protos:1.12.0
 com.google.api.grpc:proto-google-iam-v1:0.12.0
@@ -11,8 +11,8 @@ com.google.api:api-common:1.7.0
 com.google.api:gax-httpjson:0.52.1
 com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
@@ -26,24 +26,24 @@ com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
-com.google.http-client:google-http-client-jackson2:1.27.0
-com.google.http-client:google-http-client:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.44
-com.google.truth:truth:0.44
+com.google.truth.extensions:truth-java8-extension:0.45
+com.google.truth:truth:0.45
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
-io.grpc:grpc-context:1.12.0
-io.opencensus:opencensus-api:0.15.0
-io.opencensus:opencensus-contrib-http-util:0.15.0
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
@@ -54,8 +54,8 @@ net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.7
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.5.2
 org.codehaus.mojo:animal-sniffer-annotations:1.17

buildSrc/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.fasterxml.jackson.core:jackson-core:2.9.6
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.google.api-client:google-api-client:1.27.0
 com.google.api.grpc:proto-google-common-protos:1.12.0
 com.google.api.grpc:proto-google-iam-v1:0.12.0
@@ -11,8 +11,8 @@ com.google.api:api-common:1.7.0
 com.google.api:gax-httpjson:0.52.1
 com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
@@ -26,24 +26,24 @@ com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
-com.google.http-client:google-http-client-jackson2:1.27.0
-com.google.http-client:google-http-client:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.44
-com.google.truth:truth:0.44
+com.google.truth.extensions:truth-java8-extension:0.45
+com.google.truth:truth:0.45
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
-io.grpc:grpc-context:1.12.0
-io.opencensus:opencensus-api:0.15.0
-io.opencensus:opencensus-contrib-http-util:0.15.0
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
@@ -54,8 +54,8 @@ net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.7
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.5.2
 org.codehaus.mojo:animal-sniffer-annotations:1.17

buildSrc/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -3,7 +3,7 @@
 # This file is expected to be part of source control.
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
-com.fasterxml.jackson.core:jackson-core:2.9.6
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.google.api-client:google-api-client:1.27.0
 com.google.api.grpc:proto-google-common-protos:1.12.0
 com.google.api.grpc:proto-google-iam-v1:0.12.0
@@ -11,8 +11,8 @@ com.google.api:api-common:1.7.0
 com.google.api:gax-httpjson:0.52.1
 com.google.api:gax:1.35.1
 com.google.apis:google-api-services-storage:v1-rev20181013-1.27.0
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.cloud:google-cloud-core-http:1.59.0
 com.google.cloud:google-cloud-core:1.59.0
@@ -26,24 +26,24 @@ com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.0-beta1
 com.google.http-client:google-http-client-appengine:1.27.0
-com.google.http-client:google-http-client-jackson2:1.27.0
-com.google.http-client:google-http-client:1.27.0
+com.google.http-client:google-http-client-jackson2:1.30.1
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.oauth-client:google-oauth-client:1.27.0
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.44
-com.google.truth:truth:0.44
+com.google.truth.extensions:truth-java8-extension:0.45
+com.google.truth:truth:0.45
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.ibm.icu:icu4j:57.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
-io.grpc:grpc-context:1.12.0
-io.opencensus:opencensus-api:0.15.0
-io.opencensus:opencensus-contrib-http-util:0.15.0
+io.grpc:grpc-context:1.19.0
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 javax.annotation:javax.annotation-api:1.2
 javax.annotation:jsr250-api:1.0
 javax.inject:javax.inject:1
@@ -54,8 +54,8 @@ net.bytebuddy:byte-buddy-agent:1.9.7
 net.bytebuddy:byte-buddy:1.9.7
 org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.checkerframework:checker-compat-qual:2.5.5
 org.checkerframework:checker-qual:2.5.2
 org.codehaus.mojo:animal-sniffer-annotations:1.17

config/checkstyle/checkstyle.xml

@@ -25,6 +25,53 @@ by Joshua Bloch in his book Effective Java -->
     <property name="message" value='TODO is preferred to FIXME.  e.g. "TODO(johndoe): Refactor when v2 is released."' />
   </module>
 
+  <!-- Checks that String.toUpper/LowerCase() is never used without locale. -->
+  <module name="RegexpSingleline">
+    <property name="format" value="\.to(Upper|Lower)Case\(\)"/>
+    <property name="message" value="String.toUpper/LowerCase() can have unexpected results depending on locale. Either set the locale explicitly - e.g., toUpperCase(Locale.ENGLISH) - or use Ascii.toUpper/LowerCase(...) instead." />
+  </module>
+
+  <!-- Checks that DateTime.now(...) is always passed a DateTimeZone parameter. -->
+  <module name="RegexpSingleline">
+    <property name="format" value="DateTime\.now\(\)"/>
+    <property name="message" value="DateTime.now() must be called with a DateTimeZone parameter, e.g. DateTime.now(UTC)" />
+  </module>
+
+  <!-- Checks that Javadoc does not include a malformed @see tag. -->
+  <module name="RegexpSingleline">
+    <property name="format" value='@see\s\"http(|s)://'/>
+    <property name="message" value='Your Javadocs appear to use invalid &lt;a&gt; tag syntax in @see tags. Please use the correct syntax: @see &lt;a href="http(s)://your_url"&gt;url_description&lt;/a&gt;'/>
+  </module>
+
+  <!-- Checks that our Ofy wrapper is used instead of the "real" ofy(). -->
+  <module name="RegexpSingleline">
+    <property name="format" value="com\.googlecode\.objectify\.ObjectifyService\.ofy"/>
+    <property name="message" value="Use google.registry.model.ofy.ObjectifyService.ofy(). Do not use com.googlecode.objectify.v4.ObjectifyService.ofy()."/>
+  </module>
+
+  <!-- Checks that java.util.Optional is used instead of Guava's Optional. -->
+  <module name="RegexpSingleline">
+    <property name="format" value="com\.google\.common\.base\.Optional"/>
+    <property name="message" value="Use java.util.Optional instead of Guava's Optional."/>
+  </module>
+
+  <!-- Checks that our backport JUnit exception assertion methods are used instead of the ones slated for release in JUnit 4.13. -->
+  <module name="RegexpSingleline">
+    <property name="format" value="org\.junit\.Assert\.(assert|expect)Throws"/>
+    <property name="message" value="Use the exception assertion methods in google.registry.testing.JUnitBackports instead of those in JUnit."/>
+  </module>
+
+  <!-- Checks that the deprecated ExpectedException is not used. -->
+  <module name="RegexpSingleline">
+    <property name="format" value="org\.junit\.rules\.ExpectedException"/>
+    <property name="message" value="Use assertThrows and expectThrows from JUnitBackports instead of the deprecated methods on ExpectedException."/>
+  </module>
+
+  <!-- Checks that the deprecated MockitoJUnitRunner is not used. -->
+  <module name="RegexpSingleline">
+    <property name="format" value="MockitoJUnitRunner"/>
+    <property name="message" value="MockitoJUnitRunner is deprecated. Use @RunWith(JUnit4.class) and MockitoRule instead."/>
+  </module>
 
   <!-- All Java AST specific tests live under TreeWalker module. -->
   <module name="TreeWalker">

config/checkstyle/suppressions.xml

@@ -8,5 +8,7 @@
   <!-- Ignore generated files in Checkstyle -->
   <suppress files="[/\\].*[/\\]generated.*[/\\]" checks="."/>
   <!-- Ignore Javadoc checks in test files -->
-  <suppress files="[/\\].*[/\\]javatests.*[/\\]" checks="JavadocType"/>
+  <suppress files="[/\\].*[/\\]src/test/java/.*[/\\]" checks="JavadocType"/>
+  <!-- ofy() regex check doesn't apply to these files -->
+  <suppress files="AugmentedDeleter.java|AugmentedSaver.java|Ofy.java" checks="RegexpSingleline"/>
 </suppressions>

config/dependency-license/allowed_licenses.json

@@ -0,0 +1,199 @@
+{
+  "allowedLicenses": [
+    {
+      "moduleLicense": "Apache Software License, Version 1.1"
+    },
+    {
+      "moduleLicense": "Apache 2"
+    },
+    {
+      "moduleLicense": "Apache 2.0"
+    },
+    {
+      "moduleLicense": "Apache-2.0"
+    },
+    {
+      "moduleLicense": "Apache License 2.0"
+    },
+    {
+      "moduleLicense": "Apache License v2.0"
+    },
+    {
+      "moduleLicense": "Apache License, Version 2.0"
+    },
+    {
+      "moduleLicense": "Apache Software License - Version 2.0"
+    },
+    {
+      "moduleLicense": "The Apache License, Version 2.0"
+    },
+    {
+      "moduleLicense": "The Apache Software License, Version 2.0"
+    },
+    {
+      "moduleLicense": "The Apache Software License, version 2.0"
+    },
+    {
+      "moduleLicense": "Bouncy Castle Licence"
+    },
+    {
+      "moduleLicense": "BSD"
+    },
+    {
+      "moduleLicense": "BSD-2-Clause"
+    },
+    {
+      "moduleLicense": "BSD 2-Clause License"
+    },
+    {
+      "moduleLicense": "BSD 2-Clause license"
+    },
+    {
+      "moduleLicense": "BSD 3-clause"
+    },
+    {
+      "moduleLicense": "BSD 3-Clause"
+    },
+    {
+      "moduleLicense": "BSD 3-Clause License"
+    },
+    {
+      "moduleLicense": "BSD 3-clause New License"
+    },
+    {
+      "moduleLicense": "The 3-Clause BSD License"
+    },
+    {
+      "moduleLicense": "BSD License"
+    },
+    {
+      "moduleLicense": "BSD New License"
+    },
+    {
+      "moduleLicense": "BSD New license"
+    },
+    {
+      "moduleLicense": "BSD style"
+    },
+    {
+      "moduleLicense": "BSD-2-Clause"
+    },
+    {
+      "moduleLicense": "New BSD License"
+    },
+    {
+      "moduleLicense": "Revised BSD"
+    },
+    {
+      "moduleLicense": "The BSD License"
+    },
+    {
+      "moduleLicense": "The PostgreSQL License"
+    },
+    {
+      "moduleLicense": "CC0 1.0 Universal License"
+    },
+    {
+      "moduleLicense": "CDDL 1.1"
+    },
+    {
+      "moduleLicense": "CDDL + GPLv2 with classpath exception"
+    },
+    {
+      "moduleLicense": "COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0"
+    },
+    {
+      "moduleLicense": "https://glassfish.java.net/public/CDDL+GPL_1_1.html, https://glassfish.java.net/public/CDDL+GPL_1_1.html"
+    },
+    {
+      "moduleLicense": "CDDL+GPL License"
+    },
+    {
+      "moduleLicense": "\\n                Dual license consisting of the CDDL v1.1 and GPL v2\\n            "
+    },
+    {
+      "moduleLicense": "Eclipse Distribution License v. 1.0"
+    },
+    {
+      "moduleLicense": "Eclipse Public License - Version 1.0"
+    },
+    {
+      "moduleLicense": "Eclipse Public License - v 1.0"
+    },
+    {
+      "moduleLicense": "Eclipse Public License 1.0"
+    },
+    {
+      "moduleLicense": "Eclipse Public License v1.0"
+    },
+    {
+      "moduleLicense": "Google App Engine Terms of Service"
+    },
+    {
+      "moduleLicense": "GNU General Public License, version 2, with the Classpath Exception"
+    },
+    {
+      "moduleLicense": "GNU GENERAL PUBLIC LICENSE, Version 2 + Classpath Exception"
+    },
+    {
+      "moduleLicense": "GNU Library General Public License v2.1 or later"
+    },
+    {
+      "moduleLicense": "GPL2 w/ CPE"
+    },
+    {
+      "moduleLicense": "GNU Lesser Public License"
+    },
+    {
+      "moduleLicense": "GNU Library General Public License v2.1 or later"
+    },
+    {
+      "moduleLicense": "The Go license"
+    },
+    {
+      "moduleLicense": "GWT Terms"
+    },
+    {
+      "moduleLicense": "ICU License"
+    },
+    {
+      "moduleLicense": "The JSON License"
+    },
+    {
+      "moduleLicense": "LGPL-2.1+"
+    },
+    {
+      "moduleLicense": "LGPL, version 2.1"
+    },
+    {
+      "moduleLicense": "MIT"
+    },
+    {
+      "moduleLicense": "MIT License"
+    },
+    {
+      "moduleLicense": "MIT license"
+    },
+    {
+      "moduleLicense": "The MIT License"
+    },
+    {
+      "moduleLicense": "The MIT license"
+    },
+    {
+      "moduleLicense": "The PostgreSQL License"
+    },
+    {
+      "moduleLicense": "Mozilla Public License Version 2.0"
+    },
+    {
+      "moduleLicense": "Public Domain"
+    },
+    {
+      "moduleLicense": "PUBLIC DOMAIN"
+    },
+    {
+      "moduleLicense": "The W3C Software License"
+    }
+  ]
+}

config/dependency-license/license_normalizer_bundle.json

@@ -0,0 +1,32 @@
+{
+  "bundles" : [
+    {
+      "bundleName" : "Apache 2.0",
+      "licenseName" : "Apache 2.0",
+      "licenseUrl" : "http://www.apache.org/licenses/LICENSE-2.0"
+    },
+    {
+      "bundleName" : "MIT License",
+      "licenseName" : "MIT License",
+      "licenseUrl" : "http://www.opensource.org/licenses/mit-license.php"
+    }
+  ],
+  "transformationRules" : [
+    {
+      "bundleName" : "Apache 2.0",
+      "licenseUrlPattern" : "http://www.apache.org/licenses/LICENSE-2.0"
+    },
+    {
+      "bundleName" : "Apache 2.0",
+      "licenseUrlPattern" : "http://www.apache.org/licenses/LICENSE-2.0.txt"
+    },
+    {
+      "bundleName" : "MIT License",
+      "licenseUrlPattern" : "http://www.opensource.org/licenses/mit-license.php"
+    },
+    {
+      "bundleName" : "MIT License",
+      "licenseUrlPattern" : "http://www.opensource.org/licenses/MIT"
+    }
+  ]
+}

config/presubmits.py

@@ -0,0 +1,184 @@
+# Copyright 2019 The Nomulus Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Google-style presubmits for the Nomulus project.
+
+These aren't built in to the static code analysis tools we use (e.g. Checkstyle,
+Error Prone) so we must write them manually.
+"""
+
+import os
+import sys
+import re
+
+# We should never analyze any generated files
+UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "/out/"}
+# We can't rely on CI to have the Enum package installed so we do this instead.
+FORBIDDEN = 1
+REQUIRED = 2
+
+
+class PresubmitCheck:
+
+  def __init__(self,
+               regex,
+               included_extensions,
+               skipped_patterns,
+               regex_type=FORBIDDEN):
+    """Define a presubmit check for a particular set of files,
+
+        The provided prefix should always or never be included in the files.
+
+        Args:
+            regex: the regular expression to forbid or require
+            included_extensions: a tuple of extensions that define which files
+              we run over
+            skipped_patterns: a set of patterns that will cause any files that
+              include them to be skipped
+            regex_type: either FORBIDDEN or REQUIRED--whether or not the regex
+              must be present or cannot be present.
+    """
+    self.regex = regex
+    self.included_extensions = included_extensions
+    self.skipped_patterns = UNIVERSALLY_SKIPPED_PATTERNS.union(skipped_patterns)
+    self.regex_type = regex_type
+
+  def fails(self, file):
+    """ Determine whether or not this file fails the regex check.
+
+    Args:
+        file: the full path of the file to check
+    """
+    if not file.endswith(self.included_extensions):
+      return False
+    for pattern in self.skipped_patterns:
+      if pattern in file:
+        return False
+    with open(file, "r") as f:
+      file_content = f.read()
+      matches = re.match(self.regex, file_content, re.DOTALL)
+      if self.regex_type == FORBIDDEN:
+        return matches
+      return not matches
+
+
+PRESUBMITS = {
+    # License check
+    PresubmitCheck(
+        r".*Copyright 20\d{2} The Nomulus Authors\. All Rights Reserved\.",
+        ("java", "js", "soy", "sql", "py", "sh", "gradle"), {
+            ".git", "/build/", "/generated/", "node_modules/",
+            "JUnitBackports.java", "registrar_bin.", "registrar_dbg."
+        }, REQUIRED):
+        "File did not include the license header.",
+
+    # Files must end in a newline
+    PresubmitCheck(r".*\n$", ("java", "js", "soy", "sql", "py", "sh", "gradle"),
+                   {"node_modules/"}, REQUIRED):
+        "Source files must end in a newline.",
+
+    # System.(out|err).println should only appear in tools/
+    PresubmitCheck(
+        r".*\bSystem\.(out|err)\.print", "java", {
+            "StackdriverDashboardBuilder.java", "/tools/", "/example/",
+            "RegistryTestServerMain.java", "TestServerRule.java",
+            "FlowDocumentationTool.java"
+        }):
+        "System.(out|err).println is only allowed in tools/ packages. Please "
+        "use a logger instead.",
+
+    # Various Soy linting checks
+    PresubmitCheck(
+        r".* (/\*)?\* {?@param ",
+        "soy",
+        {},
+    ):
+        "In SOY please use the ({@param name: string} /** User name. */) style"
+        " parameter passing instead of the ( * @param name User name.) style "
+        "parameter pasing.",
+    PresubmitCheck(
+        r'.*\{[^}]+\w+:\s+"',
+        "soy",
+        {},
+    ):
+        "Please don't use double-quoted string literals in Soy parameters",
+    PresubmitCheck(
+        r'.*autoescape\s*=\s*"[^s]',
+        "soy",
+        {},
+    ):
+        "All soy templates must use strict autoescaping",
+    PresubmitCheck(
+        r".*noAutoescape",
+        "soy",
+        {},
+    ):
+        "All soy templates must use strict autoescaping",
+
+    # various JS linting checks
+    PresubmitCheck(
+        r".*goog\.base\(",
+        "js",
+        {"/node_modules/"},
+    ):
+        "Use of goog.base is not allowed.",
+    PresubmitCheck(
+        r".*goog\.dom\.classes",
+        "js",
+        {"/node_modules/"},
+    ):
+        "Instead of goog.dom.classes, use goog.dom.classlist which is smaller "
+        "and faster.",
+    PresubmitCheck(
+        r".*goog\.getMsg",
+        "js",
+        {"/node_modules/"},
+    ):
+        "Put messages in Soy, instead of using goog.getMsg().",
+    PresubmitCheck(
+        r".*(innerHTML|outerHTML)\s*(=|[+]=)([^=]|$)",
+        "js",
+        {"/node_modules/", "registrar_bin."},
+    ):
+        "Do not assign directly to the dom. Use goog.dom.setTextContent to set"
+        " to plain text, goog.dom.removeChildren to clear, or "
+        "soy.renderElement to render anything else",
+    PresubmitCheck(
+        r".*console\.(log|info|warn|error)",
+        "js",
+        {"/node_modules/", "google/registry/ui/js/util.js", "registrar_bin."},
+    ):
+        "JavaScript files should not include console logging."
+}
+
+
+def get_files():
+  for root, dirnames, filenames in os.walk("."):
+    for filename in filenames:
+      yield os.path.join(root, filename)
+
+
+if __name__ == "__main__":
+  failed = False
+  for file in get_files():
+    error_messages = []
+    for presubmit, error_message in PRESUBMITS.items():
+      if presubmit.fails(file):
+        error_messages.append(error_message)
+
+    if error_messages:
+      failed = True
+      print("%s had errors: \n  %s" % (file, "\n  ".join(error_messages)))
+
+  if failed:
+    sys.exit(1)

core/Dockerfile

@@ -0,0 +1,3 @@
+FROM gcr.io/distroless/java:debug
+ADD build/libs/nomulus.jar /nomulus.jar
+ENTRYPOINT ["/usr/bin/java", "-jar", "/nomulus.jar"]

core/build.gradle

@@ -1,3 +1,17 @@
+// Copyright 2019 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 plugins {
   id 'java-library'
 }
@@ -10,7 +24,8 @@ def screenshotsDir = "${project.buildDir}/screenshots"
 def screenshotsForGoldensDir = "${project.buildDir}/screenshots_for_goldens"
 def newGoldensDir = "${project.buildDir}/new_golden_images"
 def goldensDir =
-  "${javatestsDir}/google/registry/webdriver/goldens/chrome-linux"
+  "${javaTestDir}/google/registry/webdriver/goldens/chrome-linux"
+def jsDir = "${project.projectDir}/src/main/javascript"
 
 // Tests that conflict with (mostly unidentified) members of the main test
 // suite. It is unclear if they are offenders (i.e., those that pollute global
@@ -38,15 +53,19 @@ def fragileTestPatterns = [
     // Test Datastore inexplicably aborts transaction.
     "google/registry/model/tmch/ClaimsListShardTest.*",
     // Creates large object (64MBytes), occasionally throws OOM error.
-    "google/registry/model/server/KmsSecretRevisionTest.*"
+    "google/registry/model/server/KmsSecretRevisionTest.*",
+    "google/registry/tools/GenerateSqlSchemaCommandTest.*",
+    "google/registry/webdriver/*",
 ]
 
 // Tests that fail when running Gradle in a docker container, e. g. when
 // building the release artifacts in Google Cloud Build.
 def dockerIncompatibleTestPatterns = [
     // The webdriver tests start headless Chrome in a Docker container,
-    // resulting in Docker-in-Docker complications.
+    // resulting in Docker-in-Docker complications.  Likewise,
+    // GenerateSqlSchemaCommandTest launches postgresql in a docker container.
     "google/registry/webdriver/*",
+    "google/registry/tools/GenerateSqlSchemaCommandTest.*",
     // PathParameterTest includes tests which validate that file permissions are
     // respected. However when running in Docker the user is root by default, so
     // every file is read/write-able. There is no way to exclude specific test
@@ -58,26 +77,38 @@ sourceSets {
   main {
     java {
       srcDirs += generatedDir
+      // Javadoc API is deprecated and removed in Java 12.
+      // TODO(jianglai): re-enable after migrating to the new Javadoc API
+      if ((JavaVersion.current().majorVersion as Integer) > 11) {
+        exclude 'google/registry/documentation/**'
+      }
     }
     resources {
       exclude '**/*.xjb'
     }
   }
   test {
+    java {
+      // Javadoc API is deprecated and removed in Java 12.
+      // TODO(jianglai): re-enable after migrating to the new Javadoc API
+      if ((JavaVersion.current().majorVersion as Integer) > 11) {
+        exclude 'google/registry/documentation/**'
+      }
+    }
     resources {
       exclude '**/*.xjb', '**/*.xsd'
     }
   }
 }
 
+processTestResources {
+  exclude '**/webdriver/*'
+}
+
 configurations {
   css
   jaxb
   soy
-  // Label for all dependencies inherited from Bazel build but not used in
-  // either compile or testRuntime. However, they may be needed at runtime.
-  // TODO(weiminyu): identify runtime dependencies and remove the rest.
-  maybeRuntime
   closureCompiler
 
   // Exclude non-canonical servlet-api jars. Our AppEngine deployment uses
@@ -110,58 +141,41 @@ dependencies {
   // Custom-built objectify jar at commit ecd5165, included in Nomulus
   // release.
   implementation files(
-      "${rootDir}/../third_party/objectify/v4_1/objectify-4.1.3.jar")
+      "${rootDir}/third_party/objectify/v4_1/objectify-4.1.3.jar")
   testImplementation project(':third_party')
 
+  testRuntime files(sourceSets.test.resources.srcDirs)
+
   compile deps['com.beust:jcommander']
   compile deps['com.google.api-client:google-api-client']
-  maybeRuntime deps['com.google.api-client:google-api-client-appengine']
-  maybeRuntime deps['com.google.api-client:google-api-client-jackson2']
   compile deps['com.google.monitoring-client:metrics']
   compile deps['com.google.monitoring-client:stackdriver']
   compile deps['com.google.api-client:google-api-client-java6']
-  maybeRuntime deps['com.google.api-client:google-api-client-servlet']
   compile deps['com.google.apis:google-api-services-admin-directory']
   compile deps['com.google.apis:google-api-services-appengine']
   compile deps['com.google.apis:google-api-services-bigquery']
-  maybeRuntime deps['com.google.apis:google-api-services-clouddebugger']
   compile deps['com.google.apis:google-api-services-cloudkms']
-  maybeRuntime deps['com.google.apis:google-api-services-cloudresourcemanager']
   compile deps['com.google.apis:google-api-services-dataflow']
   compile deps['com.google.apis:google-api-services-dns']
   compile deps['com.google.apis:google-api-services-drive']
   compile deps['com.google.apis:google-api-services-groupssettings']
   compile deps['com.google.apis:google-api-services-monitoring']
   compile deps['com.google.apis:google-api-services-sheets']
-  maybeRuntime deps['com.google.apis:google-api-services-storage']
-  // TODO(b/71631624): change appengine:appengine-api-1.0-sdk to
-  // testCompileOnly after BillingEmailUtilsTest.java is fixed.
-  compile deps['com.google.appengine:appengine-api-1.0-sdk']
-  maybeRuntime deps['com.google.appengine:appengine-api-labs']
-  maybeRuntime deps['com.google.appengine:appengine-api-stubs']
+  testCompileOnly deps['com.google.appengine:appengine-api-1.0-sdk']
   testCompile deps['com.google.appengine:appengine-api-stubs']
   compile deps['com.google.appengine.tools:appengine-gcs-client']
   compile deps['com.google.appengine.tools:appengine-mapreduce']
   compile deps['com.google.appengine.tools:appengine-pipeline']
   compile deps['com.google.appengine:appengine-remote-api']
-  maybeRuntime deps['com.google.appengine:appengine-tools-sdk']
   compile deps['com.google.auth:google-auth-library-credentials']
   compile deps['com.google.auth:google-auth-library-oauth2-http']
-  maybeRuntime deps['com.google.auto:auto-common']
-  maybeRuntime deps['com.google.auto.factory:auto-factory']
   compile deps['com.google.code.gson:gson']
   compile deps['com.google.auto.value:auto-value-annotations']
-  maybeRuntime deps['com.google.cloud.bigdataoss:gcsio']
-  maybeRuntime deps['com.google.cloud.bigdataoss:util']
   compile deps['com.google.code.findbugs:jsr305']
   compile deps['com.google.dagger:dagger']
-  maybeRuntime deps['com.google.dagger:dagger-producers']
   compile deps['com.google.errorprone:error_prone_annotations']
-  maybeRuntime deps['com.google.errorprone:javac-shaded']
   compile deps['com.google.flogger:flogger']
   runtime deps['com.google.flogger:flogger-system-backend']
-  maybeRuntime deps['com.google.gdata:core']
-  maybeRuntime deps['com.google.googlejavaformat:google-java-format']
   compile deps['com.google.guava:guava']
   gradleLint.ignore('unused-dependency') {
     compile deps['com.google.gwt:gwt-user']
@@ -170,89 +184,51 @@ dependencies {
   compile deps['com.google.http-client:google-http-client-appengine']
   compile deps['com.google.http-client:google-http-client-jackson2']
   compile deps['com.google.oauth-client:google-oauth-client']
-  maybeRuntime deps['com.google.oauth-client:google-oauth-client-appengine']
   compile deps['com.google.oauth-client:google-oauth-client-java6']
   compile deps['com.google.oauth-client:google-oauth-client-jetty']
-  maybeRuntime deps['com.google.oauth-client:google-oauth-client-servlet']
-  maybeRuntime deps['com.google.protobuf:protobuf-java']
   compile deps['com.google.re2j:re2j']
   compile deps['com.google.template:soy']
-  maybeRuntime deps['com.googlecode.charts4j:charts4j']
   compile deps['com.googlecode.json-simple:json-simple']
   compile deps['com.jcraft:jsch']
-  maybeRuntime deps['com.jcraft:jzlib']
-  maybeRuntime deps['com.squareup:javapoet']
-  maybeRuntime deps['com.squareup:javawriter']
-  maybeRuntime deps['com.sun.activation:javax.activation']
-  maybeRuntime deps['com.thoughtworks.paranamer:paranamer']
   testCompile deps['com.thoughtworks.qdox:qdox']
-  maybeRuntime deps['commons-codec:commons-codec']
-  maybeRuntime deps['commons-logging:commons-logging']
   compile deps['dnsjava:dnsjava']
-  maybeRuntime deps['io.netty:netty-buffer']
-  maybeRuntime deps['io.netty:netty-codec']
-  maybeRuntime deps['io.netty:netty-codec-http']
-  maybeRuntime deps['io.netty:netty-common']
-  maybeRuntime deps['io.netty:netty-handler']
-  maybeRuntime deps['io.netty:netty-resolver']
-  maybeRuntime deps['io.netty:netty-tcnative']
-  maybeRuntime deps['io.netty:netty-tcnative-boringssl-static']
-  maybeRuntime deps['io.netty:netty-transport']
-  maybeRuntime deps['it.unimi.dsi:fastutil']
-  maybeRuntime deps['javax.annotation:jsr250-api']
   runtime deps['org.glassfish.jaxb:jaxb-runtime']
   testCompile deps['javax.annotation:jsr250-api']
   compile deps['javax.inject:javax.inject']
   compile deps['javax.mail:mail']
   compile deps['javax.servlet:servlet-api']
   compile deps['javax.xml.bind:jaxb-api']
-  maybeRuntime deps['javax.xml.soap:javax.xml.soap-api']
   compile deps['jline:jline']
   compile deps['joda-time:joda-time']
   compile deps['org.apache.avro:avro']
-  maybeRuntime deps['org.apache.beam:beam-runners-direct-java']
   testCompile deps['org.apache.beam:beam-runners-direct-java']
   compile deps['org.apache.beam:beam-runners-google-cloud-dataflow-java']
-  maybeRuntime deps['org.apache.beam:beam-sdks-common-runner-api']
   compile deps['org.apache.beam:beam-sdks-java-core']
   compile deps['org.apache.beam:beam-sdks-java-extensions-google-cloud-platform-core']
   compile deps['org.apache.beam:beam-sdks-java-io-google-cloud-platform']
-  maybeRuntime deps['org.apache.commons:commons-compress']
   testCompile deps['org.apache.commons:commons-text']
-  maybeRuntime deps['org.apache.ftpserver:ftplet-api']
   testCompile deps['org.apache.ftpserver:ftplet-api']
-  maybeRuntime deps['org.apache.ftpserver:ftpserver-core']
   testCompile deps['org.apache.ftpserver:ftpserver-core']
   compile deps['org.apache.httpcomponents:httpclient']
   compile deps['org.apache.httpcomponents:httpcore']
-  maybeRuntime deps['org.apache.mina:mina-core']
-  maybeRuntime deps['org.apache.sshd:sshd-core']
   testCompile deps['org.apache.sshd:sshd-core']
-  maybeRuntime deps['org.apache.sshd:sshd-scp']
   testCompile deps['org.apache.sshd:sshd-scp']
-  maybeRuntime deps['org.apache.sshd:sshd-sftp']
   testCompile deps['org.apache.sshd:sshd-sftp']
-  maybeRuntime deps['org.apache.tomcat:tomcat-annotations-api']
   testCompile deps['org.apache.tomcat:tomcat-annotations-api']
   compile deps['org.bouncycastle:bcpg-jdk15on']
   testCompile deps['org.bouncycastle:bcpkix-jdk15on']
   compile deps['org.bouncycastle:bcprov-jdk15on']
-  maybeRuntime deps['org.codehaus.jackson:jackson-core-asl']
-  maybeRuntime deps['org.codehaus.jackson:jackson-mapper-asl']
+  compile deps['org.hibernate:hibernate-core']
   compile deps['org.joda:joda-money']
   compile deps['org.json:json']
-  maybeRuntime deps['org.khronos:opengl-api']
-  maybeRuntime deps['org.mortbay.jetty:jetty']
   testCompile deps['org.mortbay.jetty:jetty']
-  maybeRuntime deps['org.mortbay.jetty:jetty-util']
+  runtimeOnly deps['org.postgresql:postgresql']
   testCompile deps['org.seleniumhq.selenium:selenium-api']
   testCompile deps['org.seleniumhq.selenium:selenium-chrome-driver']
   testCompile deps['org.seleniumhq.selenium:selenium-java']
   testCompile deps['org.seleniumhq.selenium:selenium-remote-driver']
-  maybeRuntime deps['org.slf4j:slf4j-api']
+  testCompile deps['org.testcontainers:postgresql']
   testCompile deps['org.testcontainers:selenium']
-  maybeRuntime deps['org.tukaani:xz']
-  maybeRuntime deps['org.xerial.snappy:snappy-java']
   compile deps['xerces:xmlParserAPIs']
   compile deps['xpp3:xpp3']
 
@@ -278,8 +254,10 @@ dependencies {
   testCompile deps['org.hamcrest:hamcrest-all']
   testCompile deps['org.hamcrest:hamcrest-core']
   testCompile deps['org.hamcrest:hamcrest-library']
+  compile deps['org.hibernate:hibernate-core']
   testCompile deps['junit:junit']
   testCompile deps['org.mockito:mockito-core']
+  runtime deps['org.postgresql:postgresql']
 
   // Indirect dependency found by undeclared-dependency check. Such
   // dependencies should go after all other compile and testCompile
@@ -374,7 +352,7 @@ task soyToJava {
           spec11SoyDir, toolsSoyDir, uiSoyDir, registrarSoyDir,
   ]
   soyRelativeDirs.each {
-    inputs.dir "${javaDir}/${it}"
+    inputs.dir "${resourcesSourceDir}/${it}"
     outputs.dir "${generatedDir}/${it}"
   }
 
@@ -394,19 +372,19 @@ task soyToJava {
     soyToJava('google.registry.tools.soy',
             "${generatedDir}/${toolsSoyDir}",
             fileTree(
-                    dir: "${javaDir}/${toolsSoyDir}",
+                    dir: "${resourcesSourceDir}/${toolsSoyDir}",
                     include: ['**/*.soy']))
 
     soyToJava('google.registry.ui.soy.registrar',
             "${generatedDir}/${registrarSoyDir}",
             fileTree(
-                    dir: "${javaDir}/${registrarSoyDir}",
+                    dir: "${resourcesSourceDir}/${registrarSoyDir}",
                     include: ['**/*.soy']))
 
     soyToJava('google.registry.ui.soy',
             "${generatedDir}/${uiSoyDir}",
             files {
-              file("${javaDir}/${uiSoyDir}").listFiles()
+              file("${resourcesSourceDir}/${uiSoyDir}").listFiles()
             }.filter {
               it.name.endsWith(".soy")
             })
@@ -414,13 +392,13 @@ task soyToJava {
     soyToJava('google.registry.reporting.spec11.soy',
             "${generatedDir}/${spec11SoyDir}",
             fileTree(
-                    dir: "${javaDir}/${spec11SoyDir}",
+                    dir: "${resourcesSourceDir}/${spec11SoyDir}",
                     include: ['**/*.soy']))
   }
 }
 
 task soyToJS {
-  def rootSoyDirectory = "${javaDir}/google/registry/ui/soy"
+  def rootSoyDirectory = "${resourcesSourceDir}/google/registry/ui/soy"
   def outputSoyDirectory = "${generatedDir}/google/registry/ui/soy"
   inputs.dir rootSoyDirectory
   outputs.dir outputSoyDirectory
@@ -434,7 +412,7 @@ task soyToJS {
           "--allowExternalCalls", "false",
           "--srcs", "${soyFiles.join(',')}",
           "--shouldProvideRequireSoyNamespaces", "true",
-          "--compileTimeGlobalsFile", "${javaDir}/google/registry/ui/globals.txt",
+          "--compileTimeGlobalsFile", "${resourcesSourceDir}/google/registry/ui/globals.txt",
           "--deps", "${deps.join(',')}"
     }
   }
@@ -456,7 +434,7 @@ task soyToJS {
 }
 
 task stylesheetsToJavascript {
-  def cssSourceDir = "${javaDir}/google/registry/ui/css"
+  def cssSourceDir = "${jsDir}/google/registry/ui/css"
   def outputDir = "${resourcesDir}/google/registry/ui/css"
   inputs.dir cssSourceDir
   outputs.dir outputDir
@@ -509,8 +487,8 @@ task compileProdJS(type: JavaExec) {
   def outputDir = "${resourcesDir}/google/registry/ui"
   def nodeModulesDir = "${rootDir}/node_modules"
   def cssSourceDir = "${resourcesDir}/google/registry/ui/css"
-  def jsSourceDir = "${javaDir}/google/registry/ui/js"
-  def externsDir = "${javaDir}/google/registry/ui/externs"
+  def jsSourceDir = "${jsDir}/google/registry/ui/js"
+  def externsDir = "${jsDir}/google/registry/ui/externs"
   def soySourceDir = "${generatedDir}/google/registry/ui/soy"
 
   [nodeModulesDir, cssSourceDir, jsSourceDir, externsDir, soySourceDir].each {
@@ -560,6 +538,15 @@ compileProdJS.dependsOn processTestResources
 compileProdJS.dependsOn soyToJS
 assemble.dependsOn compileProdJS
 
+task karmaTest(type: Exec) {
+  dependsOn ':npmInstall'
+  workingDir rootProject.projectDir
+  executable 'node_modules/karma/bin/karma'
+  args('start')
+}
+
+test.dependsOn karmaTest
+
 // Make testing artifacts available to be depended up on by other projects.
 // TODO: factor out google.registry.testing to be a separate project.
 task testJar(type: Jar) {
@@ -666,23 +653,26 @@ test {
   }
 }.dependsOn(fragileTest, outcastTest)
 
-task nomulus(type: Jar) {
-  manifest {
-    attributes 'Main-Class': 'google.registry.tools.RegistryTool'
-  }
-  zip64 = true
-  baseName = 'nomulus'
-  version = null
-  from {
-    configurations.runtimeClasspath.collect {
-      it.isDirectory() ? it : zipTree(it)
-    }
-  }
-  // Excludes signature files that accompany some dependency jars, like
-  // bonuncycastle. It they are present, only classes from those signed jars are
-  // made available to the class loader.
-  // see https://discuss.gradle.org/t/signing-a-custom-gradle-plugin-thats-downloaded-by-the-build-system-from-github/1365
-  exclude "META-INF/*.SF", "META-INF/*.DSA", "META-INF/*.RSA"
-  with jar
-  dependsOn project(':third_party').jar
+createUberJar('nomulus', 'nomulus', 'google.registry.tools.RegistryTool')
+project.nomulus.dependsOn project(':third_party').jar
+
+task buildToolImage(dependsOn: nomulus, type: Exec) {
+  commandLine 'docker', 'build', '-t', 'nomulus-tool', '.'
 }
+
+task copyJsFilesForTestServer(dependsOn: assemble, type: Copy) {
+  // Unfortunately the test server relies on having some compiled JS/CSS
+  // in place, so copy it over here
+  from "${resourcesDir}/google/registry/ui/"
+  include '**/*.js'
+  include '**/*.css'
+  into "${project.projectDir}/src/main/resources/google/registry/ui/"
+}
+
+task runTestServer(dependsOn: copyJsFilesForTestServer, type: JavaExec) {
+  main = 'google.registry.server.RegistryTestServerMain'
+  classpath = sourceSets.test.runtimeClasspath
+}
+
+project.build.dependsOn buildToolImage
+project.build.dependsOn ':stage'

core/gradle/dependency-locks/compile.lockfile

@@ -4,16 +4,16 @@
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
-com.beust:jcommander:1.48
+com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
 com.github.luben:zstd-jni:1.3.8-3
-com.google.api-client:google-api-client-appengine:1.28.0
+com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.28.0
-com.google.api-client:google-api-client:1.28.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
@@ -56,8 +56,8 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
@@ -83,24 +83,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-apache:2.0.0
-com.google.http-client:google-http-client-appengine:1.28.0
-com.google.http-client:google-http-client-jackson2:1.28.0
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
 com.google.http-client:google-http-client-jackson:1.20.0
-com.google.http-client:google-http-client-jdo:1.28.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.28.0
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.4
 com.google.monitoring-client:stackdriver:1.0.4
-com.google.oauth-client:google-oauth-client-appengine:1.28.0
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.28.0
-com.google.oauth-client:google-oauth-client:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -113,14 +111,14 @@ com.jcraft:jsch:0.1.55
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
 com.thoughtworks.paranamer:paranamer:2.7
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.17.1
+io.grpc:grpc-context:1.19.0
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -142,10 +140,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.18.0
+io.opencensus:opencensus-api:0.21.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.18.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.annotation:javax.annotation-api:1.2
@@ -173,8 +171,8 @@ org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
 org.apache.commons:commons-compress:1.8.1
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.5.2

core/gradle/dependency-locks/compileClasspath.lockfile

@@ -4,16 +4,16 @@
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
-com.beust:jcommander:1.48
+com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
 com.github.luben:zstd-jni:1.3.8-3
-com.google.api-client:google-api-client-appengine:1.28.0
+com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.28.0
-com.google.api-client:google-api-client:1.28.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
@@ -56,8 +56,8 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
@@ -82,24 +82,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-apache:2.0.0
-com.google.http-client:google-http-client-appengine:1.28.0
-com.google.http-client:google-http-client-jackson2:1.28.0
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
 com.google.http-client:google-http-client-jackson:1.20.0
-com.google.http-client:google-http-client-jdo:1.28.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.28.0
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.4
 com.google.monitoring-client:stackdriver:1.0.4
-com.google.oauth-client:google-oauth-client-appengine:1.28.0
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.28.0
-com.google.oauth-client:google-oauth-client:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -112,14 +110,14 @@ com.jcraft:jsch:0.1.55
 com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.13.0
 com.thoughtworks.paranamer:paranamer:2.7
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.17.1
+io.grpc:grpc-context:1.19.0
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
 io.grpc:grpc-netty:1.17.1
@@ -140,10 +138,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.18.0
+io.opencensus:opencensus-api:0.21.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.18.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.annotation:javax.annotation-api:1.2
@@ -171,8 +169,8 @@ org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
 org.apache.commons:commons-compress:1.8.1
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.5.2

core/gradle/dependency-locks/runtimeClasspath.lockfile

@@ -4,16 +4,16 @@
 aopalliance:aopalliance:1.0
 args4j:args4j:2.0.23
 cglib:cglib-nodep:2.2
-com.beust:jcommander:1.48
+com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
 com.github.luben:zstd-jni:1.3.8-3
-com.google.api-client:google-api-client-appengine:1.28.0
+com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.28.0
-com.google.api-client:google-api-client:1.28.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
@@ -56,8 +56,8 @@ com.google.appengine.tools:appengine-pipeline:0.2.13
 com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
@@ -83,24 +83,22 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-apache:2.0.0
-com.google.http-client:google-http-client-appengine:1.28.0
-com.google.http-client:google-http-client-jackson2:1.28.0
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
 com.google.http-client:google-http-client-jackson:1.20.0
-com.google.http-client:google-http-client-jdo:1.28.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.28.0
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:metrics:1.0.4
 com.google.monitoring-client:stackdriver:1.0.4
-com.google.oauth-client:google-oauth-client-appengine:1.28.0
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.28.0
-com.google.oauth-client:google-oauth-client:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
@@ -115,14 +113,14 @@ com.squareup.okio:okio:1.13.0
 com.sun.istack:istack-commons-runtime:3.0.5
 com.sun.xml.fastinfoset:FastInfoset:1.2.13
 com.thoughtworks.paranamer:paranamer:2.7
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.17.1
+io.grpc:grpc-context:1.19.0
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -144,10 +142,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.18.0
+io.opencensus:opencensus-api:0.21.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.18.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.annotation:javax.annotation-api:1.2
@@ -175,8 +173,8 @@ org.apache.beam:beam-vendor-grpc-1_13_1:0.2
 org.apache.beam:beam-vendor-guava-20_0:0.1
 org.apache.commons:commons-compress:1.8.1
 org.apache.commons:commons-lang3:3.5
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.bouncycastle:bcpg-jdk15on:1.61
 org.bouncycastle:bcprov-jdk15on:1.61
 org.checkerframework:checker-qual:2.5.2

core/gradle/dependency-locks/testCompile.lockfile

@@ -4,16 +4,16 @@
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
-com.beust:jcommander:1.48
+com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
 com.github.luben:zstd-jni:1.3.8-3
-com.google.api-client:google-api-client-appengine:1.28.0
+com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.28.0
-com.google.api-client:google-api-client:1.28.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
@@ -57,8 +57,8 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-api-stubs:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
@@ -85,32 +85,30 @@ com.google.guava:guava-testlib:25.0-jre
 com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-apache:2.0.0
-com.google.http-client:google-http-client-appengine:1.28.0
-com.google.http-client:google-http-client-jackson2:1.28.0
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
 com.google.http-client:google-http-client-jackson:1.20.0
-com.google.http-client:google-http-client-jdo:1.28.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.28.0
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:contrib:1.0.4
 com.google.monitoring-client:metrics:1.0.4
 com.google.monitoring-client:stackdriver:1.0.4
-com.google.oauth-client:google-oauth-client-appengine:1.28.0
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.28.0
-com.google.oauth-client:google-oauth-client:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.44
-com.google.truth:truth:0.44
+com.google.truth.extensions:truth-java8-extension:0.45
+com.google.truth:truth:0.45
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -123,14 +121,14 @@ com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.17.1
+io.grpc:grpc-context:1.19.0
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -152,10 +150,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.18.0
+io.opencensus:opencensus-api:0.21.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.18.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -193,8 +191,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0

core/gradle/dependency-locks/testCompileClasspath.lockfile

@@ -4,16 +4,16 @@
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
-com.beust:jcommander:1.48
+com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
 com.github.luben:zstd-jni:1.3.8-3
-com.google.api-client:google-api-client-appengine:1.28.0
+com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.28.0
-com.google.api-client:google-api-client:1.28.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
@@ -57,8 +57,8 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-api-stubs:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
@@ -84,32 +84,30 @@ com.google.guava:guava-testlib:25.0-jre
 com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-apache:2.0.0
-com.google.http-client:google-http-client-appengine:1.28.0
-com.google.http-client:google-http-client-jackson2:1.28.0
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
 com.google.http-client:google-http-client-jackson:1.20.0
-com.google.http-client:google-http-client-jdo:1.28.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.28.0
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:contrib:1.0.4
 com.google.monitoring-client:metrics:1.0.4
 com.google.monitoring-client:stackdriver:1.0.4
-com.google.oauth-client:google-oauth-client-appengine:1.28.0
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.28.0
-com.google.oauth-client:google-oauth-client:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.44
-com.google.truth:truth:0.44
+com.google.truth.extensions:truth-java8-extension:0.45
+com.google.truth:truth:0.45
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -122,14 +120,14 @@ com.squareup.okhttp:okhttp:2.5.0
 com.squareup.okio:okio:1.14.0
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.17.1
+io.grpc:grpc-context:1.19.0
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
 io.grpc:grpc-netty:1.17.1
@@ -150,10 +148,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.18.0
+io.opencensus:opencensus-api:0.21.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.18.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -191,8 +189,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0

core/gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -4,16 +4,16 @@
 aopalliance:aopalliance:1.0
 args4j:args4j:2.33
 cglib:cglib-nodep:2.2
-com.beust:jcommander:1.48
+com.beust:jcommander:1.60
 com.fasterxml.jackson.core:jackson-annotations:2.9.8
-com.fasterxml.jackson.core:jackson-core:2.9.8
+com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.8
 com.github.luben:zstd-jni:1.3.8-3
-com.google.api-client:google-api-client-appengine:1.28.0
+com.google.api-client:google-api-client-appengine:1.29.0
 com.google.api-client:google-api-client-jackson2:1.27.0
 com.google.api-client:google-api-client-java6:1.27.0
-com.google.api-client:google-api-client-servlet:1.28.0
-com.google.api-client:google-api-client:1.28.0
+com.google.api-client:google-api-client-servlet:1.29.0
+com.google.api-client:google-api-client:1.29.2
 com.google.api.grpc:grpc-google-cloud-bigquerystorage-v1beta1:0.44.0
 com.google.api.grpc:grpc-google-cloud-bigtable-admin-v2:0.38.0
 com.google.api.grpc:grpc-google-cloud-bigtable-v2:0.44.0
@@ -57,8 +57,8 @@ com.google.appengine:appengine-api-1.0-sdk:1.9.48
 com.google.appengine:appengine-api-stubs:1.9.48
 com.google.appengine:appengine-remote-api:1.9.48
 com.google.appengine:appengine-testing:1.9.58
-com.google.auth:google-auth-library-credentials:0.12.0
-com.google.auth:google-auth-library-oauth2-http:0.12.0
+com.google.auth:google-auth-library-credentials:0.16.1
+com.google.auth:google-auth-library-oauth2-http:0.16.1
 com.google.auto.value:auto-value-annotations:1.6.3
 com.google.auto.value:auto-value:1.6.3
 com.google.cloud.bigdataoss:gcsio:1.9.16
@@ -85,32 +85,30 @@ com.google.guava:guava-testlib:25.0-jre
 com.google.guava:guava:27.1-jre
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.gwt:gwt-user:2.8.2
-com.google.http-client:google-http-client-apache:2.0.0
-com.google.http-client:google-http-client-appengine:1.28.0
-com.google.http-client:google-http-client-jackson2:1.28.0
+com.google.http-client:google-http-client-appengine:1.29.2
+com.google.http-client:google-http-client-jackson2:1.30.1
 com.google.http-client:google-http-client-jackson:1.20.0
-com.google.http-client:google-http-client-jdo:1.28.0
 com.google.http-client:google-http-client-protobuf:1.20.0
-com.google.http-client:google-http-client:1.28.0
+com.google.http-client:google-http-client:1.30.1
 com.google.inject.extensions:guice-multibindings:4.1.0
 com.google.inject:guice:4.1.0
-com.google.j2objc:j2objc-annotations:1.1
+com.google.j2objc:j2objc-annotations:1.3
 com.google.jsinterop:jsinterop-annotations:1.0.2
 com.google.monitoring-client:contrib:1.0.4
 com.google.monitoring-client:metrics:1.0.4
 com.google.monitoring-client:stackdriver:1.0.4
-com.google.oauth-client:google-oauth-client-appengine:1.28.0
+com.google.oauth-client:google-oauth-client-appengine:1.29.0
 com.google.oauth-client:google-oauth-client-java6:1.28.0
 com.google.oauth-client:google-oauth-client-jetty:1.28.0
-com.google.oauth-client:google-oauth-client-servlet:1.28.0
-com.google.oauth-client:google-oauth-client:1.28.0
+com.google.oauth-client:google-oauth-client-servlet:1.29.0
+com.google.oauth-client:google-oauth-client:1.29.2
 com.google.protobuf.nano:protobuf-javanano:3.0.0-alpha-5
 com.google.protobuf:protobuf-java-util:3.6.1
 com.google.protobuf:protobuf-java:3.6.1
 com.google.re2j:re2j:1.1
 com.google.template:soy:2018-03-14
-com.google.truth.extensions:truth-java8-extension:0.44
-com.google.truth:truth:0.44
+com.google.truth.extensions:truth-java8-extension:0.45
+com.google.truth:truth:0.45
 com.googlecode.charts4j:charts4j:1.3
 com.googlecode.java-diff-utils:diffutils:1.3.0
 com.googlecode.json-simple:json-simple:1.1.1
@@ -125,14 +123,14 @@ com.sun.istack:istack-commons-runtime:3.0.5
 com.sun.xml.fastinfoset:FastInfoset:1.2.13
 com.thoughtworks.paranamer:paranamer:2.7
 com.thoughtworks.qdox:qdox:1.12.1
-commons-codec:commons-codec:1.10
+commons-codec:commons-codec:1.11
 commons-logging:commons-logging:1.2
 dnsjava:dnsjava:2.1.7
 io.dropwizard.metrics:metrics-core:3.1.2
 io.grpc:grpc-all:1.17.1
 io.grpc:grpc-alts:1.17.1
 io.grpc:grpc-auth:1.17.1
-io.grpc:grpc-context:1.17.1
+io.grpc:grpc-context:1.19.0
 io.grpc:grpc-core:1.17.1
 io.grpc:grpc-grpclb:1.17.1
 io.grpc:grpc-netty-shaded:1.17.1
@@ -154,10 +152,10 @@ io.netty:netty-handler:4.1.30.Final
 io.netty:netty-resolver:4.1.30.Final
 io.netty:netty-tcnative-boringssl-static:2.0.17.Final
 io.netty:netty-transport:4.1.30.Final
-io.opencensus:opencensus-api:0.18.0
+io.opencensus:opencensus-api:0.21.0
 io.opencensus:opencensus-contrib-grpc-metrics:0.17.0
 io.opencensus:opencensus-contrib-grpc-util:0.17.0
-io.opencensus:opencensus-contrib-http-util:0.18.0
+io.opencensus:opencensus-contrib-http-util:0.21.0
 it.unimi.dsi:fastutil:6.5.16
 javax.activation:activation:1.1
 javax.activation:javax.activation-api:1.2.0
@@ -195,8 +193,8 @@ org.apache.commons:commons-lang3:3.8.1
 org.apache.commons:commons-text:1.6
 org.apache.ftpserver:ftplet-api:1.0.6
 org.apache.ftpserver:ftpserver-core:1.0.6
-org.apache.httpcomponents:httpclient:4.5.5
-org.apache.httpcomponents:httpcore:4.4.9
+org.apache.httpcomponents:httpclient:4.5.8
+org.apache.httpcomponents:httpcore:4.4.11
 org.apache.mina:mina-core:2.0.4
 org.apache.sshd:sshd-core:2.0.0
 org.apache.sshd:sshd-scp:2.0.0

core/src/main/java/google/registry/backup/CommitLogCheckpointAction.java

@@ -19,6 +19,7 @@ import static com.google.appengine.api.taskqueue.TaskOptions.Builder.withUrl;
 import static google.registry.backup.ExportCommitLogDiffAction.LOWER_CHECKPOINT_TIME_PARAM;
 import static google.registry.backup.ExportCommitLogDiffAction.UPPER_CHECKPOINT_TIME_PARAM;
 import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
 
 import com.google.common.flogger.FluentLogger;
@@ -63,7 +64,7 @@ public final class CommitLogCheckpointAction implements Runnable {
     final CommitLogCheckpoint checkpoint = strategy.computeCheckpoint();
     logger.atInfo().log(
         "Generated candidate checkpoint for time: %s", checkpoint.getCheckpointTime());
-    ofy()
+    tm()
         .transact(
             () -> {
               DateTime lastWrittenTime = CommitLogCheckpointRoot.loadRoot().getLastWrittenTime();

core/src/main/java/google/registry/backup/DeleteOldCommitLogsAction.java

@@ -18,6 +18,7 @@ import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Preconditions.checkState;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static java.lang.Boolean.FALSE;
 import static java.lang.Boolean.TRUE;
 
@@ -276,7 +277,7 @@ public final class DeleteOldCommitLogsAction implements Runnable {
         return;
       }
 
-      DeletionResult deletionResult = ofy().transactNew(() -> {
+      DeletionResult deletionResult = tm().transactNew(() -> {
         CommitLogManifest manifest = ofy().load().key(manifestKey).now();
         // It is possible that the same manifestKey was run twice, if a shard had to be restarted
         // or some weird failure. If this happens, we want to exit immediately.

core/src/main/java/google/registry/batch/DeleteContactsAndHostsAction.java

@@ -39,6 +39,7 @@ import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE;
 import static google.registry.model.reporting.HistoryEntry.Type.CONTACT_DELETE_FAILURE;
 import static google.registry.model.reporting.HistoryEntry.Type.HOST_DELETE;
 import static google.registry.model.reporting.HistoryEntry.Type.HOST_DELETE_FAILURE;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.model.transfer.TransferStatus.SERVER_CANCELLED;
 import static java.math.RoundingMode.CEILING;
 import static java.util.concurrent.TimeUnit.DAYS;
@@ -308,7 +309,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
       final boolean hasNoActiveReferences = !Iterators.contains(values, true);
       logger.atInfo().log("Processing async deletion request for %s", deletionRequest.key());
       DeletionResult result =
-          ofy()
+          tm()
               .transactNew(
                   () -> {
                     DeletionResult deletionResult =
@@ -329,7 +330,7 @@ public class DeleteContactsAndHostsAction implements Runnable {
 
     private DeletionResult attemptToDeleteResource(
         DeletionRequest deletionRequest, boolean hasNoActiveReferences) {
-      DateTime now = ofy().getTransactionTime();
+      DateTime now = tm().getTransactionTime();
       EppResource resource =
           ofy().load().key(deletionRequest.key()).now().cloneProjectedAtTime(now);
       // Double-check transactionally that the resource is still active and in PENDING_DELETE.

core/src/main/java/google/registry/batch/DeleteLoadTestDataAction.java

@@ -19,6 +19,7 @@ import static google.registry.config.RegistryEnvironment.PRODUCTION;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.mapreduce.inputs.EppResourceInputs.createEntityInput;
 import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 
 import com.google.appengine.tools.mapreduce.Mapper;
@@ -73,7 +74,6 @@ public class DeleteLoadTestDataAction implements Runnable {
 
   @Inject MapreduceRunner mrRunner;
   @Inject Response response;
-  @Inject RegistryEnvironment registryEnvironment;
 
   @Inject
   DeleteLoadTestDataAction() {}
@@ -84,7 +84,8 @@ public class DeleteLoadTestDataAction implements Runnable {
     // run on production. On other environments, data is fully wiped out occasionally anyway, so
     // having some broken data that isn't referred to isn't the end of the world.
     checkState(
-        registryEnvironment != PRODUCTION, "This mapreduce is not safe to run on PRODUCTION.");
+        !RegistryEnvironment.get().equals(PRODUCTION),
+        "This mapreduce is not safe to run on PRODUCTION.");
 
     mrRunner
         .setJobName("Delete load test data")
@@ -124,7 +125,7 @@ public class DeleteLoadTestDataAction implements Runnable {
           Key.create(EppResourceIndex.create(Key.create(resource)));
       final Key<? extends ForeignKeyIndex<?>> fki = ForeignKeyIndex.createKey(resource);
       int numEntitiesDeleted =
-          ofy()
+          tm()
               .transact(
                   () -> {
                     // This ancestor query selects all descendant entities.

core/src/main/java/google/registry/batch/DeleteProberDataAction.java

@@ -17,11 +17,13 @@ package google.registry.batch;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
 import static com.google.common.collect.ImmutableSet.toImmutableSet;
+import static google.registry.config.RegistryEnvironment.PRODUCTION;
 import static google.registry.mapreduce.MapreduceRunner.PARAM_DRY_RUN;
 import static google.registry.model.ResourceTransferUtils.updateForeignKeyIndexDeletionTime;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.registry.Registries.getTldsOfType;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_DELETE;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.request.Action.Method.POST;
 import static google.registry.request.RequestParameters.PARAM_TLDS;
 import static org.joda.time.DateTimeZone.UTC;
@@ -77,7 +79,6 @@ public class DeleteProberDataAction implements Runnable {
   @Inject @Config("registryAdminClientId") String registryAdminClientId;
   @Inject MapreduceRunner mrRunner;
   @Inject Response response;
-  @Inject RegistryEnvironment registryEnvironment;
   @Inject DeleteProberDataAction() {}
 
   @Override
@@ -96,7 +97,7 @@ public class DeleteProberDataAction implements Runnable {
 
   private ImmutableSet<String> getProberRoidSuffixes() {
     checkArgument(
-        !RegistryEnvironment.PRODUCTION.equals(registryEnvironment)
+        !PRODUCTION.equals(RegistryEnvironment.get())
             || tlds.stream().allMatch(tld -> tld.endsWith(".test")),
         "On production, can only work on TLDs that end with .test");
     ImmutableSet<String> deletableTlds =
@@ -219,7 +220,7 @@ public class DeleteProberDataAction implements Runnable {
       final Key<? extends ForeignKeyIndex<?>> fki = ForeignKeyIndex.createKey(domain);
 
       int entitiesDeleted =
-          ofy()
+          tm()
               .transact(
                   () -> {
                     // This ancestor query selects all descendant HistoryEntries, BillingEvents,
@@ -245,16 +246,16 @@ public class DeleteProberDataAction implements Runnable {
     }
 
     private void softDeleteDomain(final DomainBase domain) {
-      ofy().transactNew(() -> {
+      tm().transactNew(() -> {
           DomainBase deletedDomain = domain
               .asBuilder()
-              .setDeletionTime(ofy().getTransactionTime())
+              .setDeletionTime(tm().getTransactionTime())
               .setStatusValues(null)
               .build();
           HistoryEntry historyEntry = new HistoryEntry.Builder()
               .setParent(domain)
               .setType(DOMAIN_DELETE)
-              .setModificationTime(ofy().getTransactionTime())
+              .setModificationTime(tm().getTransactionTime())
               .setBySuperuser(true)
               .setReason("Deletion of prober data")
               .setClientId(registryAdminClientId)

core/src/main/java/google/registry/batch/ExpandRecurringBillingEventsAction.java

@@ -23,6 +23,7 @@ import static google.registry.model.common.Cursor.CursorType.RECURRING_BILLING;
 import static google.registry.model.domain.Period.Unit.YEARS;
 import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.model.reporting.HistoryEntry.Type.DOMAIN_AUTORENEW;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 import static google.registry.pricing.PricingEngineProxy.getDomainRenewCost;
 import static google.registry.util.CollectionUtils.union;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
@@ -150,7 +151,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
       }
       int numBillingEventsSaved = 0;
       try {
-        numBillingEventsSaved = ofy().transactNew(() -> {
+        numBillingEventsSaved = tm().transactNew(() -> {
           ImmutableSet.Builder<OneTime> syntheticOneTimesBuilder =
               new ImmutableSet.Builder<>();
           final Registry tld = Registry.get(getTldFromDomainName(recurring.getTargetId()));
@@ -183,7 +184,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
             HistoryEntry historyEntry = new HistoryEntry.Builder()
                 .setBySuperuser(false)
                 .setClientId(recurring.getClientId())
-                .setModificationTime(ofy().getTransactionTime())
+                .setModificationTime(tm().getTransactionTime())
                 .setParent(domainKey)
                 .setPeriod(Period.create(1, YEARS))
                 .setReason("Domain autorenewal by ExpandRecurringBillingEventsAction")
@@ -308,7 +309,7 @@ public class ExpandRecurringBillingEventsAction implements Runnable {
       logger.atInfo().log(
           "Recurring event expansion %s complete for billing event range [%s, %s).",
           isDryRun ? "(dry run) " : "", cursorTime, executionTime);
-      ofy()
+      tm()
           .transact(
               () -> {
                 Cursor cursor = ofy().load().key(Cursor.createGlobalKey(RECURRING_BILLING)).now();

core/src/main/java/google/registry/batch/ResaveAllEppResourcesAction.java

@@ -15,6 +15,7 @@
 package google.registry.batch;
 
 import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 
 import com.google.appengine.tools.mapreduce.Mapper;
 import com.google.common.collect.ImmutableList;
@@ -69,7 +70,7 @@ public class ResaveAllEppResourcesAction implements Runnable {
 
     @Override
     public final void map(final Key<EppResource> resourceKey) {
-      ofy()
+      tm()
           .transact(
               () -> {
                 EppResource projectedResource =
@@ -77,7 +78,7 @@ public class ResaveAllEppResourcesAction implements Runnable {
                         .load()
                         .key(resourceKey)
                         .now()
-                        .cloneProjectedAtTime(ofy().getTransactionTime());
+                        .cloneProjectedAtTime(tm().getTransactionTime());
                 ofy().save().entity(projectedResource).now();
               });
       getContext().incrementCounter(String.format("%s entities re-saved", resourceKey.getKind()));

core/src/main/java/google/registry/batch/ResaveEntityAction.java

@@ -18,6 +18,7 @@ import static google.registry.batch.AsyncTaskEnqueuer.PARAM_REQUESTED_TIME;
 import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESAVE_TIMES;
 import static google.registry.batch.AsyncTaskEnqueuer.PARAM_RESOURCE_KEY;
 import static google.registry.model.ofy.ObjectifyService.ofy;
+import static google.registry.model.transaction.TransactionManagerFactory.tm;
 
 import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedSet;
@@ -73,11 +74,11 @@ public class ResaveEntityAction implements Runnable {
   public void run() {
     logger.atInfo().log(
         "Re-saving entity %s which was enqueued at %s.", resourceKey, requestedTime);
-    ofy().transact(() -> {
+    tm().transact(() -> {
       ImmutableObject entity = ofy().load().key(resourceKey).now();
       ofy().save().entity(
           (entity instanceof EppResource)
-              ? ((EppResource) entity).cloneProjectedAtTime(ofy().getTransactionTime()) : entity
+              ? ((EppResource) entity).cloneProjectedAtTime(tm().getTransactionTime()) : entity
       );
       if (!resaveTimes.isEmpty()) {
         asyncTaskEnqueuer.enqueueAsyncResave(entity, requestedTime, resaveTimes);

core/src/main/java/google/registry/beam/invoicing/InvoicingPipeline.java

@@ -14,17 +14,14 @@
 
 package google.registry.beam.invoicing;
 
-import static java.nio.charset.StandardCharsets.UTF_8;
-
 import com.google.auth.oauth2.GoogleCredentials;
 import google.registry.beam.invoicing.BillingEvent.InvoiceGroupingKey;
 import google.registry.beam.invoicing.BillingEvent.InvoiceGroupingKey.InvoiceGroupingKeyCoder;
-import google.registry.config.CredentialModule.LocalCredentialJson;
+import google.registry.config.CredentialModule.LocalCredential;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.reporting.billing.BillingModule;
 import google.registry.reporting.billing.GenerateInvoicesAction;
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
+import google.registry.util.GoogleCredentialsBundle;
 import java.io.Serializable;
 import javax.inject.Inject;
 import org.apache.beam.runners.dataflow.DataflowRunner;
@@ -61,34 +58,31 @@ import org.apache.beam.sdk.values.TypeDescriptors;
  */
 public class InvoicingPipeline implements Serializable {
 
-  @Inject
-  @Config("projectId")
-  String projectId;
+  private final String projectId;
+  private final String beamBucketUrl;
+  private final String invoiceTemplateUrl;
+  private final String beamStagingUrl;
+  private final String billingBucketUrl;
+  private final String invoiceFilePrefix;
+  private final GoogleCredentials googleCredentials;
 
   @Inject
-  @Config("apacheBeamBucketUrl")
-  String beamBucketUrl;
-
-  @Inject
-  @Config("invoiceTemplateUrl")
-  String invoiceTemplateUrl;
-
-  @Inject
-  @Config("beamStagingUrl")
-  String beamStagingUrl;
-
-  @Inject
-  @Config("billingBucketUrl")
-  String billingBucketUrl;
-
-  @Inject
-  @Config("invoiceFilePrefix")
-  String invoiceFilePrefix;
-
-  @Inject @LocalCredentialJson String credentialJson;
-
-  @Inject
-  InvoicingPipeline() {}
+  public InvoicingPipeline(
+      @Config("projectId") String projectId,
+      @Config("apacheBeamBucketUrl") String beamBucketUrl,
+      @Config("invoiceTemplateUrl") String invoiceTemplateUrl,
+      @Config("beamStagingUrl") String beamStagingUrl,
+      @Config("billingBucketUrl") String billingBucketUrl,
+      @Config("invoiceFilePrefix") String invoiceFilePrefix,
+      @LocalCredential GoogleCredentialsBundle googleCredentialsBundle) {
+    this.projectId = projectId;
+    this.beamBucketUrl = beamBucketUrl;
+    this.invoiceTemplateUrl = invoiceTemplateUrl;
+    this.beamStagingUrl = beamStagingUrl;
+    this.billingBucketUrl = billingBucketUrl;
+    this.invoiceFilePrefix = invoiceFilePrefix;
+    this.googleCredentials = googleCredentialsBundle.getGoogleCredentials();
+  }
 
   /** Custom options for running the invoicing pipeline. */
   interface InvoicingPipelineOptions extends DataflowPipelineOptions {
@@ -108,18 +102,15 @@ public class InvoicingPipeline implements Serializable {
   public void deploy() {
     // We can't store options as a member variable due to serialization concerns.
     InvoicingPipelineOptions options = PipelineOptionsFactory.as(InvoicingPipelineOptions.class);
-    try {
-      options.setGcpCredential(
-          GoogleCredentials.fromStream(new ByteArrayInputStream(credentialJson.getBytes(UTF_8))));
-    } catch (IOException e) {
-      throw new RuntimeException(
-          "Cannot obtain local credential to deploy the invoicing pipeline", e);
-    }
     options.setProject(projectId);
     options.setRunner(DataflowRunner.class);
     // This causes p.run() to stage the pipeline as a template on GCS, as opposed to running it.
     options.setTemplateLocation(invoiceTemplateUrl);
     options.setStagingLocation(beamStagingUrl);
+    // This credential is used when Dataflow deploys the template to GCS in target GCP project.
+    // So, make sure the credential has write permission to GCS in that project.
+    options.setGcpCredential(googleCredentials);
+
     Pipeline p = Pipeline.create(options);
 
     PCollection<BillingEvent> billingEvents =

core/src/main/java/google/registry/beam/spec11/Spec11Pipeline.java

@@ -17,9 +17,12 @@ package google.registry.beam.spec11;
 import static com.google.common.base.Preconditions.checkArgument;
 import static google.registry.beam.BeamUtils.getQueryFromFile;
 
+import com.google.auth.oauth2.GoogleCredentials;
 import com.google.auto.value.AutoValue;
 import google.registry.beam.spec11.SafeBrowsingTransforms.EvaluateSafeBrowsingFn;
+import google.registry.config.CredentialModule.LocalCredential;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.util.GoogleCredentialsBundle;
 import google.registry.util.Retrier;
 import google.registry.util.SqlTemplate;
 import java.io.Serializable;
@@ -77,26 +80,29 @@ public class Spec11Pipeline implements Serializable {
   /** The JSON object field we put the threat match array for Spec11 reports. */
   public static final String THREAT_MATCHES_FIELD = "threatMatches";
 
-  @Inject
-  @Config("projectId")
-  String projectId;
+  private final String projectId;
+  private final String beamStagingUrl;
+  private final String spec11TemplateUrl;
+  private final String reportingBucketUrl;
+  private final GoogleCredentials googleCredentials;
+  private final Retrier retrier;
 
   @Inject
-  @Config("beamStagingUrl")
-  String beamStagingUrl;
-
-  @Inject
-  @Config("spec11TemplateUrl")
-  String spec11TemplateUrl;
-
-  @Inject
-  @Config("reportingBucketUrl")
-  String reportingBucketUrl;
-
-  @Inject Retrier retrier;
-
-  @Inject
-  Spec11Pipeline() {}
+  public Spec11Pipeline(
+      @Config("projectId") String projectId,
+      @Config("beamStagingUrl") String beamStagingUrl,
+      @Config("spec11TemplateUrl") String spec11TemplateUrl,
+      @Config("reportingBucketUrl") String reportingBucketUrl,
+      @LocalCredential GoogleCredentialsBundle googleCredentialsBundle,
+      Retrier retrier
+  ) {
+    this.projectId = projectId;
+    this.beamStagingUrl = beamStagingUrl;
+    this.spec11TemplateUrl = spec11TemplateUrl;
+    this.reportingBucketUrl = reportingBucketUrl;
+    this.googleCredentials = googleCredentialsBundle.getGoogleCredentials();
+    this.retrier = retrier;
+  }
 
   /** Custom options for running the spec11 pipeline. */
   interface Spec11PipelineOptions extends DataflowPipelineOptions {
@@ -134,6 +140,9 @@ public class Spec11Pipeline implements Serializable {
     // This causes p.run() to stage the pipeline as a template on GCS, as opposed to running it.
     options.setTemplateLocation(spec11TemplateUrl);
     options.setStagingLocation(beamStagingUrl);
+    // This credential is used when Dataflow deploys the template to GCS in target GCP project.
+    // So, make sure the credential has write permission to GCS in that project.
+    options.setGcpCredential(googleCredentials);
 
     Pipeline p = Pipeline.create(options);
     PCollection<Subdomain> domains =

core/src/main/java/google/registry/bigquery/BigqueryConnection.java

@@ -727,7 +727,7 @@ public class BigqueryConnection implements AutoCloseable {
               .setProjectId(getProjectId())
               .setDatasetId(datasetName)))
           .execute();
-      System.err.printf("Created dataset: %s:%s\n", getProjectId(), datasetName);
+      logger.atInfo().log("Created dataset: %s:%s\n", getProjectId(), datasetName);
       return true;
     }
     return false;

core/src/main/java/google/registry/bigquery/BigqueryModule.java

@@ -14,7 +14,6 @@
 
 package google.registry.bigquery;
 
-import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
 import com.google.api.services.bigquery.Bigquery;
 import com.google.api.services.bigquery.model.TableFieldSchema;
 import com.google.common.collect.ImmutableList;
@@ -23,24 +22,29 @@ import dagger.Provides;
 import dagger.multibindings.Multibinds;
 import google.registry.config.CredentialModule.DefaultCredential;
 import google.registry.config.RegistryConfig.Config;
+import google.registry.util.GoogleCredentialsBundle;
 import java.util.Map;
 
 /** Dagger module for Google {@link Bigquery} connection objects. */
 @Module
 public abstract class BigqueryModule {
 
-  /** Provides a map of BigQuery table names to field names. */
-  @Multibinds
-  abstract Map<String, ImmutableList<TableFieldSchema>> bigquerySchemas();
+  // No subclasses.
+  private BigqueryModule() {}
 
   @Provides
   static Bigquery provideBigquery(
-      @DefaultCredential GoogleCredential credential, @Config("projectId") String projectId) {
-    return new Bigquery.Builder(credential.getTransport(), credential.getJsonFactory(), credential)
+      @DefaultCredential GoogleCredentialsBundle credentialsBundle,
+      @Config("projectId") String projectId) {
+    return new Bigquery.Builder(
+            credentialsBundle.getHttpTransport(),
+            credentialsBundle.getJsonFactory(),
+            credentialsBundle.getHttpRequestInitializer())
         .setApplicationName(projectId)
         .build();
   }
 
-  // No subclasses.
-  private BigqueryModule() {}
+  /** Provides a map of BigQuery table names to field names. */
+  @Multibinds
+  abstract Map<String, ImmutableList<TableFieldSchema>> bigquerySchemas();
 }

core/src/main/java/google/registry/config/CredentialModule.java

@@ -17,31 +17,28 @@ package google.registry.config;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
-import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
-import com.google.api.client.googleapis.util.Utils;
+import com.google.auth.oauth2.GoogleCredentials;
 import com.google.common.collect.ImmutableList;
 import dagger.Module;
 import dagger.Provides;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.keyring.api.KeyModule.Key;
+import google.registry.util.GoogleCredentialsBundle;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.io.UncheckedIOException;
 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
-import java.security.GeneralSecurityException;
 import javax.inject.Qualifier;
 import javax.inject.Singleton;
 
-/**
- * Dagger module that provides all {@link GoogleCredential GoogleCredentials} used in the
- * application.
- */
+/** Dagger module that provides all {@link GoogleCredentials} used in the application. */
 @Module
 public abstract class CredentialModule {
 
   /**
-   * Provides the default {@link GoogleCredential} from the Google Cloud runtime.
+   * Provides the default {@link GoogleCredentialsBundle} from the Google Cloud runtime.
    *
    * <p>The credential returned depends on the runtime environment:
    *
@@ -58,7 +55,30 @@ public abstract class CredentialModule {
   @DefaultCredential
   @Provides
   @Singleton
-  public static GoogleCredential provideDefaultCredential(
+  public static GoogleCredentialsBundle provideDefaultCredential(
+      @Config("defaultCredentialOauthScopes") ImmutableList<String> requiredScopes) {
+    GoogleCredentials credential;
+    try {
+      credential = GoogleCredentials.getApplicationDefault();
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+    if (credential.createScopedRequired()) {
+      credential = credential.createScoped(requiredScopes);
+    }
+    return GoogleCredentialsBundle.create(credential);
+  }
+
+  /**
+   * Provides the default {@link GoogleCredential} from the Google Cloud runtime for G Suite
+   * Drive API.
+   * TODO(b/138195359): Deprecate this credential once we figure out how to use
+   * {@link GoogleCredentials} for G Suite Drive API.
+   */
+  @GSuiteDriveCredential
+  @Provides
+  @Singleton
+  public static GoogleCredential provideGSuiteDriveCredential(
       @Config("defaultCredentialOauthScopes") ImmutableList<String> requiredScopes) {
     GoogleCredential credential;
     try {
@@ -66,35 +86,6 @@ public abstract class CredentialModule {
     } catch (IOException e) {
       throw new RuntimeException(e);
     }
-    if (credential.createScopedRequired()) {
-      return credential.createScoped(requiredScopes);
-    }
-    return credential;
-  }
-
-  /**
-   * Provides a {@link GoogleCredential} from the service account's JSON key file.
-   *
-   * <p>On App Engine, a thread created using Java's built-in API needs this credential when it
-   * calls App Engine API. The Google Sheets API also needs this credential.
-   */
-  @JsonCredential
-  @Provides
-  @Singleton
-  public static GoogleCredential provideJsonCredential(
-      @Config("defaultCredentialOauthScopes") ImmutableList<String> requiredScopes,
-      @Key("jsonCredential") String jsonCredential) {
-    GoogleCredential credential;
-    try {
-      credential =
-          GoogleCredential.fromStream(
-              new ByteArrayInputStream(jsonCredential.getBytes(UTF_8)),
-              // We cannot use UrlFetchTransport as that uses App Engine API.
-              GoogleNetHttpTransport.newTrustedTransport(),
-              Utils.getDefaultJsonFactory());
-    } catch (IOException | GeneralSecurityException e) {
-      throw new RuntimeException(e);
-    }
     if (credential.createScopedRequired()) {
       credential = credential.createScoped(requiredScopes);
     }
@@ -102,7 +93,32 @@ public abstract class CredentialModule {
   }
 
   /**
-   * Provides a {@link GoogleCredential} with delegated admin access for a G Suite domain.
+   * Provides a {@link GoogleCredentialsBundle} from the service account's JSON key file.
+   *
+   * <p>On App Engine, a thread created using Java's built-in API needs this credential when it
+   * calls App Engine API. The Google Sheets API also needs this credential.
+   */
+  @JsonCredential
+  @Provides
+  @Singleton
+  public static GoogleCredentialsBundle provideJsonCredential(
+      @Config("defaultCredentialOauthScopes") ImmutableList<String> requiredScopes,
+      @Key("jsonCredential") String jsonCredential) {
+    GoogleCredentials credential;
+    try {
+      credential =
+          GoogleCredentials.fromStream(new ByteArrayInputStream(jsonCredential.getBytes(UTF_8)));
+    } catch (IOException e) {
+      throw new UncheckedIOException(e);
+    }
+    if (credential.createScopedRequired()) {
+      credential = credential.createScoped(requiredScopes);
+    }
+    return GoogleCredentialsBundle.create(credential);
+  }
+
+  /**
+   * Provides a {@link GoogleCredentialsBundle} with delegated admin access for a G Suite domain.
    *
    * <p>The G Suite domain must grant delegated admin access to the registry service account with
    * all scopes in {@code requiredScopes}, including ones not related to G Suite.
@@ -110,18 +126,14 @@ public abstract class CredentialModule {
   @DelegatedCredential
   @Provides
   @Singleton
-  public static GoogleCredential provideDelegatedCredential(
+  public static GoogleCredentialsBundle provideDelegatedCredential(
       @Config("delegatedCredentialOauthScopes") ImmutableList<String> requiredScopes,
-      @JsonCredential GoogleCredential googleCredential,
+      @JsonCredential GoogleCredentialsBundle credentialsBundle,
       @Config("gSuiteAdminAccountEmailAddress") String gSuiteAdminAccountEmailAddress) {
-    return new GoogleCredential.Builder()
-        .setTransport(Utils.getDefaultTransport())
-        .setJsonFactory(Utils.getDefaultJsonFactory())
-        .setServiceAccountId(googleCredential.getServiceAccountId())
-        .setServiceAccountPrivateKey(googleCredential.getServiceAccountPrivateKey())
-        .setServiceAccountScopes(requiredScopes)
-        .setServiceAccountUser(gSuiteAdminAccountEmailAddress)
-        .build();
+    return GoogleCredentialsBundle.create(credentialsBundle
+        .getGoogleCredentials()
+        .createDelegated(gSuiteAdminAccountEmailAddress)
+        .createScoped(requiredScopes));
   }
 
   /** Dagger qualifier for the Application Default Credential. */
@@ -130,6 +142,13 @@ public abstract class CredentialModule {
   @Retention(RetentionPolicy.RUNTIME)
   public @interface DefaultCredential {}
 
+
+  /** Dagger qualifier for the credential for G Suite Drive API. */
+  @Qualifier
+  @Documented
+  @Retention(RetentionPolicy.RUNTIME)
+  public @interface GSuiteDriveCredential {}
+
   /**
    * Dagger qualifier for a credential from a service account's JSON key, to be used in non-request
    * threads.

core/src/main/java/google/registry/config/RegistryConfig.java

@@ -94,13 +94,6 @@ public final class RegistryConfig {
   @Module
   public static final class ConfigModule {
 
-    private static final RegistryEnvironment REGISTRY_ENVIRONMENT = RegistryEnvironment.get();
-
-    @Provides
-    public static RegistryEnvironment provideRegistryEnvironment() {
-      return REGISTRY_ENVIRONMENT;
-    }
-
     @Provides
     @Config("projectId")
     public static String provideProjectId(RegistryConfigSettings config) {
@@ -901,9 +894,9 @@ public final class RegistryConfig {
      * @see google.registry.reporting.spec11.Spec11EmailUtils
      */
     @Provides
-    @Config("spec11ReplyToEmailAddress")
-    public static InternetAddress provideSpec11ReplyToEmailAddress(RegistryConfigSettings config) {
-      return parseEmailAddress(config.misc.spec11ReplyToEmailAddress);
+    @Config("spec11OutgoingEmailAddress")
+    public static InternetAddress provideSpec11OutgoingEmailAddress(RegistryConfigSettings config) {
+      return parseEmailAddress(config.misc.spec11OutgoingEmailAddress);
     }
 
     /**

core/src/main/java/google/registry/config/RegistryConfigSettings.java

@@ -173,7 +173,7 @@ public class RegistryConfigSettings {
   public static class Misc {
     public String sheetExportId;
     public String alertRecipientEmailAddress;
-    public String spec11ReplyToEmailAddress;
+    public String spec11OutgoingEmailAddress;
     public int asyncDeleteDelaySeconds;
     public int transientFailureRetries;
   }

core/src/main/java/google/registry/config/files/default-config.yaml

@@ -357,9 +357,9 @@ misc:
   # Address we send alert summary emails to.
   alertRecipientEmailAddress: email@example.com
 
-  # Address to which the Spec 11 emails to registrars should be replied. This needs
-  # to be a deliverable email address in case the registrars want to contact us.
-  spec11ReplyToEmailAddress: reply-to@example.com
+  # Address from which Spec 11 emails to registrars are sent. This needs
+  # to be a deliverable email address to handle replies from registrars as well.
+  spec11OutgoingEmailAddress: abuse@example.com
 
   # How long to delay processing of asynchronous deletions. This should always
   # be longer than eppResourceCachingSeconds, to prevent deleted contacts or