thirdPartyAudit round 2

This fixes the `lenient` parameter to be `missingClasses`. I will remove this boolean and we can handle them via the normal whitelist.
It also adds a check for sheisty classes (jar hell with the jdk).
This is inspired by the lucene "sheisty" classes check, but it has false positives. This check is more evil, it validates every class file against the extension classloader as a resource, to see if it exists there. If so: jar hell.

This jar hell is a problem for several reasons:

1. causes insanely-hard-to-debug problems (like bugs in forbidden-apis)
2. hides problems (like internal api access)
3. the code you think is executing, is not really executing
4. security permissions are not what you think they are
5. brings in unnecessary dependencies
6. its jar hell

The more difficult problems are stuff like jython, where these classes are simply 'uberjared' directly in, so you cant just fix them by removing a bogus dependency. And there is a legit reason for them to do that, they want to support java 1.4.

buildSrc/src/main/groovy/org/elasticsearch/gradle/precommit/ThirdPartyAuditTask.groovy

@@ -18,6 +18,12 @@
  */
 package org.elasticsearch.gradle.precommit
 
+import java.nio.file.Files
+import java.nio.file.FileVisitResult
+import java.nio.file.Path
+import java.nio.file.SimpleFileVisitor
+import java.nio.file.attribute.BasicFileAttributes
+
 import org.gradle.api.DefaultTask
 import org.gradle.api.artifacts.UnknownConfigurationException
 import org.gradle.api.file.FileCollection
@@ -32,7 +38,7 @@ import org.apache.tools.ant.Project
 public class ThirdPartyAuditTask extends DefaultTask {
 
     // true to be lenient about MISSING CLASSES
-    private boolean lenient;
+    private boolean missingClasses;
     
     // patterns for classes to exclude, because we understand their issues
     private String[] excludes = new String[0];
@@ -43,19 +49,19 @@ public class ThirdPartyAuditTask extends DefaultTask {
     }
 
     /** 
-     * Set to true to be lenient with dependencies. By default this check will fail if it finds
+     * Set to true to be lenient with missing classes. By default this check will fail if it finds
      * MISSING CLASSES. This means the set of jars is incomplete. However, in some cases
      * this can be due to intentional exclusions that are well-tested and understood.
      */      
-    public void setLenient(boolean value) {
-        lenient = value;
+    public void setMissingClasses(boolean value) {
+        missingClasses = value;
     }
     
     /**
      * Returns true if leniency about missing classes is enabled.
      */
-    public boolean isLenient() {
-        return lenient;
+    public boolean isMissingClasses() {
+        return missingClasses;
     }
     
     /**
@@ -118,9 +124,10 @@ public class ThirdPartyAuditTask extends DefaultTask {
         }
         logger.error("[thirdPartyAudit] Scanning: " + names)
         
-        // warn that you won't see any forbidden apis warnings
-        if (lenient) {
-            logger.warn("[thirdPartyAudit] WARNING: leniency is enabled, will not fail if classes are missing!")
+        // warn that classes are missing
+        // TODO: move these to excludes list!
+        if (missingClasses) {
+            logger.warn("[thirdPartyAudit] WARNING: CLASSES ARE MISSING! Expect NoClassDefFoundError in bug reports from users!")
         }
         
         // TODO: forbidden-apis + zipfileset gives O(n^2) behavior unless we dump to a tmpdir first, 
@@ -135,7 +142,7 @@ public class ThirdPartyAuditTask extends DefaultTask {
         for (File jar : jars) {
             ant.unzip(src: jar.getAbsolutePath(), dest: tmpDir.getAbsolutePath())
         }
-
+        
         // convert exclusion class names to binary file names
         String[] excludedFiles = new String[excludes.length];
         for (int i = 0; i < excludes.length; i++) {
@@ -146,13 +153,55 @@ public class ThirdPartyAuditTask extends DefaultTask {
             }
         }
         
+        // jarHellReprise
+        checkSheistyClasses(tmpDir.toPath(), new HashSet<>(Arrays.asList(excludedFiles)));
+        
         ant.thirdPartyAudit(internalRuntimeForbidden: true, 
                             failOnUnsupportedJava: false, 
-                            failOnMissingClasses: !lenient,
+                            failOnMissingClasses: !missingClasses,
                             classpath: project.configurations.testCompile.asPath) {
             fileset(dir: tmpDir, excludes: excludedFiles.join(','))
         }
         // clean up our mess (if we succeed)
         ant.delete(dir: tmpDir.getAbsolutePath())
     }
+    
+    /**
+     * check for sheisty classes: if they also exist in the extensions classloader, its jar hell with the jdk!
+     */
+    private void checkSheistyClasses(Path root, Set<String> excluded) {
+        // system.parent = extensions loader.
+        // note: for jigsaw, this evilness will need modifications (e.g. use jrt filesystem!). 
+        // but groovy/gradle needs to work at all first!
+        ClassLoader ext = ClassLoader.getSystemClassLoader().getParent()
+        assert ext != null
+        
+        Set<String> sheistySet = new TreeSet<>();
+        Files.walkFileTree(root, new SimpleFileVisitor<Path>() {
+            @Override
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) throws IOException {
+                String entry = root.relativize(file).toString()
+                if (entry.endsWith(".class")) {
+                    if (ext.getResource(entry) != null) {
+                        sheistySet.add(entry);
+                    }
+                }
+                return FileVisitResult.CONTINUE;
+            }
+        });
+        
+        // check if we are ok
+        if (sheistySet.isEmpty()) {
+            return;
+        }
+        
+        // leniency against exclusions list
+        sheistySet.removeAll(excluded);
+        
+        if (sheistySet.isEmpty()) {
+            logger.warn("[thirdPartyAudit] WARNING: JAR HELL WITH JDK! Expect insanely hard-to-debug problems!")
+        } else {
+            throw new IllegalStateException("JAR HELL WITH JDK! " + sheistySet);
+        }
+    }
 }

core/build.gradle

@@ -112,7 +112,7 @@ forbiddenPatterns {
 }
 
 // classes are missing, e.g. org.jboss.marshalling.Marshaller
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 // uses internal sun ssl classes!
 thirdPartyAudit.excludes = [
     // uses internal java api: sun.security.x509 (X509CertInfo, X509CertImpl, X500Name)

modules/lang-expression/build.gradle

@@ -35,7 +35,7 @@ dependencyLicenses {
 
 // do we or do we not depend on asm-tree, that is the question
 // classes are missing, e.g. org.objectweb.asm.tree.LabelNode
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 
 compileJava.options.compilerArgs << '-Xlint:-rawtypes'
 compileTestJava.options.compilerArgs << '-Xlint:-rawtypes'

modules/lang-groovy/build.gradle

@@ -37,7 +37,7 @@ integTest {
 }
 
 // classes are missing, e.g. jline.console.completer.Completer
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 thirdPartyAudit.excludes = [
     // uses internal java api: sun.misc.Unsafe
     'groovy.json.internal.FastStringUtils',

plugins/discovery-azure/build.gradle

@@ -37,15 +37,12 @@ dependencies {
   compile "commons-lang:commons-lang:2.6"
   compile "commons-io:commons-io:2.4"
   compile 'javax.mail:mail:1.4.5'
-  compile 'javax.activation:activation:1.1'
   compile 'javax.inject:javax.inject:1'
   compile "com.sun.jersey:jersey-client:${versions.jersey}"
   compile "com.sun.jersey:jersey-core:${versions.jersey}"
   compile "com.sun.jersey:jersey-json:${versions.jersey}"
   compile 'org.codehaus.jettison:jettison:1.1' 
   compile 'com.sun.xml.bind:jaxb-impl:2.2.3-1'
-  compile 'javax.xml.bind:jaxb-api:2.2.2'
-  compile 'javax.xml.stream:stax-api:1.0-2'
   compile 'org.codehaus.jackson:jackson-core-asl:1.9.2'
   compile 'org.codehaus.jackson:jackson-mapper-asl:1.9.2'
   compile 'org.codehaus.jackson:jackson-jaxrs:1.9.2'
@@ -57,7 +54,6 @@ dependencyLicenses {
   mapping from: /jackson-.*/, to: 'jackson'
   mapping from: /jersey-.*/, to: 'jersey'
   mapping from: /jaxb-.*/, to: 'jaxb'
-  mapping from: /stax-.*/, to: 'stax'
 }
 
 compileJava.options.compilerArgs << '-Xlint:-path,-serial,-static,-unchecked'
@@ -67,9 +63,10 @@ compileJava.options.compilerArgs << '-Xlint:-deprecation'
 compileTestJava.options.compilerArgs << '-Xlint:-static'
 
 // classes are missing, e.g. org.osgi.framework.BundleActivator
-thirdPartyAudit.lenient = true
-// WE ARE JAR HELLING WITH THE JDK AND THAT IS WHY THIS HAPPENS
-// TODO: fix this!!!!!!!!!!!
+thirdPartyAudit.missingClasses = true
+// TODO: figure out what is happening and fix this!!!!!!!!!!!
+// there might be still some undetected jar hell!
+// we need to fix https://github.com/policeman-tools/forbidden-apis/issues/91 first
 thirdPartyAudit.excludes = [
     // uses internal java api: com.sun.xml.fastinfoset.stax.StAXDocumentParser
     'com.sun.xml.bind.v2.runtime.unmarshaller.FastInfosetConnector',

plugins/discovery-azure/licenses/activation-1.1.jar.sha1

@@ -1 +0,0 @@
-e6cb541461c2834bdea3eb920f1884d1eb508b50

plugins/discovery-azure/licenses/activation-LICENSE.txt

@@ -1,119 +0,0 @@
-COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0
-
-1. Definitions.
-
-1.1. Contributor means each individual or entity that creates or contributes to the creation of Modifications.
-
-1.2. Contributor Version means the combination of the Original Software, prior Modifications used by a Contributor (if any), and the Modifications made by that particular Contributor.
-
-1.3. Covered Software means (a) the Original Software, or (b) Modifications, or (c) the combination of files containing Original Software with files containing Modifications, in each case including portions thereof.
-
-1.4. Executable means the Covered Software in any form other than Source Code.
-
-1.5. Initial Developer means the individual or entity that first makes Original Software available under this License.
-
-1.6. Larger Work means a work which combines Covered Software or portions thereof with code not governed by the terms of this License.
-
-1.7. License means this document.
-
-1.8. Licensable means having the right to grant, to the maximum extent possible, whether at the time of the initial grant or subsequently acquired, any and all of the rights conveyed herein.
-
-1.9. Modifications means the Source Code and Executable form of any of the following:
-
-A. Any file that results from an addition to, deletion from or modification of the contents of a file containing Original Software or previous Modifications;
-
-B. Any new file that contains any part of the Original Software or previous Modification; or
-
-C. Any new file that is contributed or otherwise made available under the terms of this License.
-
-1.10. Original Software means the Source Code and Executable form of computer software code that is originally released under this License.
-
-1.11. Patent Claims means any patent claim(s), now owned or hereafter acquired, including without limitation, method, process, and apparatus claims, in any patent Licensable by grantor.
-
-1.12. Source Code means (a) the common form of computer software code in which modifications are made and (b) associated documentation included in or with such code.
-
-1.13. You (or Your) means an individual or a legal entity exercising rights under, and complying with all of the terms of, this License. For legal entities, You includes any entity which controls, is controlled by, or is under common control with You. For purposes of this definition, control means (a)áthe power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b)áownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of such entity.
-
-2. License Grants.
-
-2.1. The Initial Developer Grant.
-Conditioned upon Your compliance with Section 3.1 below and subject to third party intellectual property claims, the Initial Developer hereby grants You a world-wide, royalty-free, non-exclusive license:
-(a) under intellectual property rights (other than patent or trademark) Licensable by Initial Developer, to use, reproduce, modify, display, perform, sublicense and distribute the Original Software (or portions thereof), with or without Modifications, and/or as part of a Larger Work; and
-(b) under Patent Claims infringed by the making, using or selling of Original Software, to make, have made, use, practice, sell, and offer for sale, and/or otherwise dispose of the Original Software (or portions thereof).
-(c) The licenses granted in Sectionsá2.1(a) and (b) are effective on the date Initial Developer first distributes or otherwise makes the Original Software available to a third party under the terms of this License.
-(d) Notwithstanding Sectioná2.1(b) above, no patent license is granted: (1)áfor code that You delete from the Original Software, or (2)áfor infringements caused by: (i)áthe modification of the Original Software, or (ii)áthe combination of the Original Software with other software or devices.
-
-2.2. Contributor Grant.
-Conditioned upon Your compliance with Section 3.1 below and subject to third party intellectual property claims, each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license:
-(a) under intellectual property rights (other than patent or trademark) Licensable by Contributor to use, reproduce, modify, display, perform, sublicense and distribute the Modifications created by such Contributor (or portions thereof), either on an unmodified basis, with other Modifications, as Covered Software and/or as part of a Larger Work; and
-(b) under Patent Claims infringed by the making, using, or selling of Modifications made by that Contributor either alone and/or in combination with its Contributor Version (or portions of such combination), to make, use, sell, offer for sale, have made, and/or otherwise dispose of: (1)áModifications made by that Contributor (or portions thereof); and (2)áthe combination of Modifications made by that Contributor with its Contributor Version (or portions of such combination).
-(c) The licenses granted in Sectionsá2.2(a) and 2.2(b) are effective on the date Contributor first distributes or otherwise makes the Modifications available to a third party.
-(d) Notwithstanding Sectioná2.2(b) above, no patent license is granted: (1)áfor any code that Contributor has deleted from the Contributor Version; (2)áfor infringements caused by: (i)áthird party modifications of Contributor Version, or (ii)áthe combination of Modifications made by that Contributor with other software (except as part of the Contributor Version) or other devices; or (3)áunder Patent Claims infringed by Covered Software in the absence of Modifications made by that Contributor.
-
-3. Distribution Obligations.
-
-3.1. Availability of Source Code.
-
-Any Covered Software that You distribute or otherwise make available in Executable form must also be made available in Source Code form and that Source Code form must be distributed only under the terms of this License. You must include a copy of this License with every copy of the Source Code form of the Covered Software You distribute or otherwise make available. You must inform recipients of any such Covered Software in Executable form as to how they can obtain such Covered Software in Source Code form in a reasonable manner on or through a medium customarily used for software exchange.
-
-3.2. Modifications.
-
-The Modifications that You create or to which You contribute are governed by the terms of this License. You represent that You believe Your Modifications are Your original creation(s) and/or You have sufficient rights to grant the rights conveyed by this License.
-
-3.3. Required Notices.
-You must include a notice in each of Your Modifications that identifies You as the Contributor of the Modification. You may not remove or alter any copyright, patent or trademark notices contained within the Covered Software, or any notices of licensing or any descriptive text giving attribution to any Contributor or the Initial Developer.
-
-3.4. Application of Additional Terms.
-You may not offer or impose any terms on any Covered Software in Source Code form that alters or restricts the applicable version of this License or the recipients rights hereunder. You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Software. However, you may do so only on Your own behalf, and not on behalf of the Initial Developer or any Contributor. You must make it absolutely clear that any such warranty, support, indemnity or liability obligation is offered by You alone, and You hereby agree to indemnify the Initial Developer and every Contributor for any liability incurred by the Initial Developer or such Contributor as a result of warranty, support, indemnity or liability terms You offer.
-
-3.5. Distribution of Executable Versions.
-You may distribute the Executable form of the Covered Software under the terms of this License or under the terms of a license of Your choice, which may contain terms different from this License, provided that You are in compliance with the terms of this License and that the license for the Executable form does not attempt to limit or alter the recipients rights in the Source Code form from the rights set forth in this License. If You distribute the Covered Software in Executable form under a different license, You must make it absolutely clear that any terms which differ from this License are offered by You alone, not by the Initial Developer or Contributor. You hereby agree to indemnify the Initial Developer and every Contributor for any liability incurred by the Initial Developer or such Contributor as a result of any such terms You offer.
-
-3.6. Larger Works.
-You may create a Larger Work by combining Covered Software with other code not governed by the terms of this License and distribute the Larger Work as a single product. In such a case, You must make sure the requirements of this License are fulfilled for the Covered Software.
-
-4. Versions of the License.
-
-4.1. New Versions.
-Sun Microsystems, Inc. is the initial license steward and may publish revised and/or new versions of this License from time to time. Each version will be given a distinguishing version number. Except as provided in Section 4.3, no one other than the license steward has the right to modify this License.
-
-4.2. Effect of New Versions.
-
-You may always continue to use, distribute or otherwise make the Covered Software available under the terms of the version of the License under which You originally received the Covered Software. If the Initial Developer includes a notice in the Original Software prohibiting it from being distributed or otherwise made available under any subsequent version of the License, You must distribute and make the Covered Software available under the terms of the version of the License under which You originally received the Covered Software. Otherwise, You may also choose to use, distribute or otherwise make the Covered Software available under the terms of any subsequent version of the License published by the license steward.
-4.3. Modified Versions.
-
-When You are an Initial Developer and You want to create a new license for Your Original Software, You may create and use a modified version of this License if You: (a)árename the license and remove any references to the name of the license steward (except to note that the license differs from this License); and (b)áotherwise make it clear that the license contains terms which differ from this License.
-
-5. DISCLAIMER OF WARRANTY.
-
-COVERED SOFTWARE IS PROVIDED UNDER THIS LICENSE ON AN AS IS BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE COVERED SOFTWARE IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE COVERED SOFTWARE IS WITH YOU. SHOULD ANY COVERED SOFTWARE PROVE DEFECTIVE IN ANY RESPECT, YOU (NOT THE INITIAL DEVELOPER OR ANY OTHER CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY COVERED SOFTWARE IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER.
-
-6. TERMINATION.
-
-6.1. This License and the rights granted hereunder will terminate automatically if You fail to comply with terms herein and fail to cure such breach within 30 days of becoming aware of the breach. Provisions which, by their nature, must remain in effect beyond the termination of this License shall survive.
-
-6.2. If You assert a patent infringement claim (excluding declaratory judgment actions) against Initial Developer or a Contributor (the Initial Developer or Contributor against whom You assert such claim is referred to as Participant) alleging that the Participant Software (meaning the Contributor Version where the Participant is a Contributor or the Original Software where the Participant is the Initial Developer) directly or indirectly infringes any patent, then any and all rights granted directly or indirectly to You by such Participant, the Initial Developer (if the Initial Developer is not the Participant) and all Contributors under Sectionsá2.1 and/or 2.2 of this License shall, upon 60 days notice from Participant terminate prospectively and automatically at the expiration of such 60 day notice period, unless if within such 60 day period You withdraw Your claim with respect to the Participant Software against such Participant either unilaterally or pursuant to a written agreement with Participant.
-
-6.3. In the event of termination under Sectionsá6.1 or 6.2 above, all end user licenses that have been validly granted by You or any distributor hereunder prior to termination (excluding licenses granted to You by any distributor) shall survive termination.
-
-7. LIMITATION OF LIABILITY.
-
-UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL YOU, THE INITIAL DEVELOPER, ANY OTHER CONTRIBUTOR, OR ANY DISTRIBUTOR OF COVERED SOFTWARE, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO ANY PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOST PROFITS, LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES, EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY RESULTING FROM SUCH PARTYS NEGLIGENCE TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH LIMITATION. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS EXCLUSION AND LIMITATION MAY NOT APPLY TO YOU.
-
-8. U.S. GOVERNMENT END USERS.
-
-The Covered Software is a commercial item, as that term is defined in 48áC.F.R.á2.101 (Oct. 1995), consisting of commercial computer software (as that term is defined at 48 C.F.R. á252.227-7014(a)(1)) and commercial computer software documentation as such terms are used in 48áC.F.R.á12.212 (Sept. 1995). Consistent with 48 C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4 (June 1995), all U.S. Government End Users acquire Covered Software with only those rights set forth herein. This U.S. Government Rights clause is in lieu of, and supersedes, any other FAR, DFAR, or other clause or provision that addresses Government rights in computer software under this License.
-
-9. MISCELLANEOUS.
-
-This License represents the complete agreement concerning subject matter hereof. If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable. This License shall be governed by the law of the jurisdiction specified in a notice contained within the Original Software (except to the extent applicable law, if any, provides otherwise), excluding such jurisdictions conflict-of-law provisions. Any litigation relating to this License shall be subject to the jurisdiction of the courts located in the jurisdiction and venue specified in a notice contained within the Original Software, with the losing party responsible for costs, including, without limitation, court costs and reasonable attorneys fees and expenses. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded. Any law or regulation which provides that the language of a contract shall be construed against the drafter shall not apply to this License. You agree that You alone are responsible for compliance with the United States export administration regulations (and the export control laws and regulation of any other countries) when You use, distribute or otherwise make available any Covered Software.
-
-10. RESPONSIBILITY FOR CLAIMS.
-
-As between Initial Developer and the Contributors, each party is responsible for claims and damages arising, directly or indirectly, out of its utilization of rights under this License and You agree to work with Initial Developer and Contributors to distribute such responsibility on an equitable basis. Nothing herein is intended or shall be deemed to constitute any admission of liability.
-
-NOTICE PURSUANT TO SECTION 9 OF THE COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL)
-The GlassFish code released under the CDDL shall be governed by the laws of the State of California (excluding conflict-of-law provisions). Any litigation relating to this License shall be subject to the jurisdiction of the Federal Courts of the Northern District of California and the state courts of the State of California, with venue lying in Santa Clara County, California. 
-
-
-

plugins/discovery-azure/licenses/activation-NOTICE.txt

@@ -1 +0,0 @@
- 

plugins/discovery-azure/licenses/jaxb-api-2.2.2.jar.sha1

@@ -1 +0,0 @@
-aeb3021ca93dde265796d82015beecdcff95bf09

plugins/discovery-azure/licenses/stax-LICENSE.txt

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

plugins/discovery-azure/licenses/stax-NOTICE.txt

@@ -1 +0,0 @@
- 

plugins/discovery-azure/licenses/stax-api-1.0-2.jar.sha1

@@ -1 +0,0 @@
-d6337b0de8b25e53e81b922352fbea9f9f57ba0b

plugins/discovery-ec2/build.gradle

@@ -50,7 +50,7 @@ test {
 }
 
 // classes are missing, e.g. org.apache.avalon.framework.logger.Logger
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 thirdPartyAudit.excludes = [
     // uses internal java api: com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl
     // uses internal java api: com.sun.org.apache.xml.internal.dtm.ref.DTMManagerDefault

plugins/discovery-gce/build.gradle

@@ -33,4 +33,4 @@ test {
 }
 
 // classes are missing, e.g. org.apache.log.Logger
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true

plugins/lang-plan-a/build.gradle

@@ -34,7 +34,7 @@ compileJava.options.compilerArgs << '-Xlint:-cast,-fallthrough,-rawtypes'
 compileTestJava.options.compilerArgs << '-Xlint:-unchecked'
 
 // classes are missing, e.g. org.objectweb.asm.tree.LabelNode
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 
 // regeneration logic, comes in via ant right now
 // don't port it to gradle, it works fine.

plugins/lang-python/build.gradle

@@ -37,7 +37,7 @@ integTest {
 }
 
 // classes are missing, e.g. org.tukaani.xz.FilterOptions
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 thirdPartyAudit.excludes = [
     // uses internal java api: sun.security.x509 (X509CertInfo, X509CertImpl, X500Name)
     'org.python.netty.handler.ssl.util.OpenJdkSelfSignedCertGenerator',
@@ -72,4 +72,344 @@ thirdPartyAudit.excludes = [
     'org.python.netty.util.internal.chmv8.ForkJoinPool$WorkQueue',
     'org.python.netty.util.internal.chmv8.ForkJoinTask',
     'org.python.netty.util.internal.chmv8.ForkJoinTask$1',
+
+    // "uberjaring" (but not shading) classes that have been in the JDK since 1.5
+    // nice job python.
+    'javax.xml.XMLConstants',
+    'javax.xml.datatype.DatatypeConfigurationException',
+    'javax.xml.datatype.DatatypeConstants$1',
+    'javax.xml.datatype.DatatypeConstants$Field',
+    'javax.xml.datatype.DatatypeConstants',
+    'javax.xml.datatype.DatatypeFactory',
+    'javax.xml.datatype.Duration',
+    'javax.xml.datatype.FactoryFinder',
+    'javax.xml.datatype.SecuritySupport$1',
+    'javax.xml.datatype.SecuritySupport$2',
+    'javax.xml.datatype.SecuritySupport$3',
+    'javax.xml.datatype.SecuritySupport$4',
+    'javax.xml.datatype.SecuritySupport$5',
+    'javax.xml.datatype.SecuritySupport',
+    'javax.xml.datatype.XMLGregorianCalendar',
+    'javax.xml.namespace.NamespaceContext',
+    'javax.xml.namespace.QName$1',
+    'javax.xml.namespace.QName',
+    'javax.xml.parsers.DocumentBuilder',
+    'javax.xml.parsers.DocumentBuilderFactory',
+    'javax.xml.parsers.FactoryConfigurationError',
+    'javax.xml.parsers.FactoryFinder',
+    'javax.xml.parsers.ParserConfigurationException',
+    'javax.xml.parsers.SAXParser',
+    'javax.xml.parsers.SAXParserFactory',
+    'javax.xml.parsers.SecuritySupport$1',
+    'javax.xml.parsers.SecuritySupport$2',
+    'javax.xml.parsers.SecuritySupport$3',
+    'javax.xml.parsers.SecuritySupport$4',
+    'javax.xml.parsers.SecuritySupport$5',
+    'javax.xml.parsers.SecuritySupport',
+    'javax.xml.stream.EventFilter',
+    'javax.xml.stream.FactoryConfigurationError',
+    'javax.xml.stream.FactoryFinder',
+    'javax.xml.stream.Location',
+    'javax.xml.stream.SecuritySupport$1',
+    'javax.xml.stream.SecuritySupport$2',
+    'javax.xml.stream.SecuritySupport$3',
+    'javax.xml.stream.SecuritySupport$4',
+    'javax.xml.stream.SecuritySupport$5',
+    'javax.xml.stream.SecuritySupport',
+    'javax.xml.stream.StreamFilter',
+    'javax.xml.stream.XMLEventFactory',
+    'javax.xml.stream.XMLEventReader',
+    'javax.xml.stream.XMLEventWriter',
+    'javax.xml.stream.XMLInputFactory',
+    'javax.xml.stream.XMLOutputFactory',
+    'javax.xml.stream.XMLReporter',
+    'javax.xml.stream.XMLResolver',
+    'javax.xml.stream.XMLStreamConstants',
+    'javax.xml.stream.XMLStreamException',
+    'javax.xml.stream.XMLStreamReader',
+    'javax.xml.stream.XMLStreamWriter',
+    'javax.xml.stream.events.Attribute',
+    'javax.xml.stream.events.Characters',
+    'javax.xml.stream.events.Comment',
+    'javax.xml.stream.events.DTD',
+    'javax.xml.stream.events.EndDocument',
+    'javax.xml.stream.events.EndElement',
+    'javax.xml.stream.events.EntityDeclaration',
+    'javax.xml.stream.events.EntityReference',
+    'javax.xml.stream.events.Namespace',
+    'javax.xml.stream.events.NotationDeclaration',
+    'javax.xml.stream.events.ProcessingInstruction',
+    'javax.xml.stream.events.StartDocument',
+    'javax.xml.stream.events.StartElement',
+    'javax.xml.stream.events.XMLEvent',
+    'javax.xml.stream.util.EventReaderDelegate',
+    'javax.xml.stream.util.StreamReaderDelegate',
+    'javax.xml.stream.util.XMLEventAllocator',
+    'javax.xml.stream.util.XMLEventConsumer',
+    'javax.xml.transform.ErrorListener',
+    'javax.xml.transform.FactoryFinder',
+    'javax.xml.transform.OutputKeys',
+    'javax.xml.transform.Result',
+    'javax.xml.transform.SecuritySupport$1',
+    'javax.xml.transform.SecuritySupport$2',
+    'javax.xml.transform.SecuritySupport$3',
+    'javax.xml.transform.SecuritySupport$4',
+    'javax.xml.transform.SecuritySupport$5',
+    'javax.xml.transform.SecuritySupport',
+    'javax.xml.transform.Source',
+    'javax.xml.transform.SourceLocator',
+    'javax.xml.transform.Templates',
+    'javax.xml.transform.Transformer',
+    'javax.xml.transform.TransformerConfigurationException',
+    'javax.xml.transform.TransformerException',
+    'javax.xml.transform.TransformerFactory',
+    'javax.xml.transform.TransformerFactoryConfigurationError',
+    'javax.xml.transform.URIResolver',
+    'javax.xml.transform.dom.DOMLocator',
+    'javax.xml.transform.dom.DOMResult',
+    'javax.xml.transform.dom.DOMSource',
+    'javax.xml.transform.sax.SAXResult',
+    'javax.xml.transform.sax.SAXSource',
+    'javax.xml.transform.sax.SAXTransformerFactory',
+    'javax.xml.transform.sax.TemplatesHandler',
+    'javax.xml.transform.sax.TransformerHandler',
+    'javax.xml.transform.stax.StAXResult',
+    'javax.xml.transform.stax.StAXSource',
+    'javax.xml.transform.stream.StreamResult',
+    'javax.xml.transform.stream.StreamSource',
+    'javax.xml.validation.Schema',
+    'javax.xml.validation.SchemaFactory',
+    'javax.xml.validation.SchemaFactoryFinder$1',
+    'javax.xml.validation.SchemaFactoryFinder$2',
+    'javax.xml.validation.SchemaFactoryFinder',
+    'javax.xml.validation.SchemaFactoryLoader',
+    'javax.xml.validation.SecuritySupport$1',
+    'javax.xml.validation.SecuritySupport$2',
+    'javax.xml.validation.SecuritySupport$3',
+    'javax.xml.validation.SecuritySupport$4',
+    'javax.xml.validation.SecuritySupport$5',
+    'javax.xml.validation.SecuritySupport$6',
+    'javax.xml.validation.SecuritySupport$7',
+    'javax.xml.validation.SecuritySupport$8',
+    'javax.xml.validation.SecuritySupport',
+    'javax.xml.validation.TypeInfoProvider',
+    'javax.xml.validation.Validator',
+    'javax.xml.validation.ValidatorHandler',
+    'javax.xml.xpath.SecuritySupport$1',
+    'javax.xml.xpath.SecuritySupport$2',
+    'javax.xml.xpath.SecuritySupport$3',
+    'javax.xml.xpath.SecuritySupport$4',
+    'javax.xml.xpath.SecuritySupport$5',
+    'javax.xml.xpath.SecuritySupport$6',
+    'javax.xml.xpath.SecuritySupport$7',
+    'javax.xml.xpath.SecuritySupport$8',
+    'javax.xml.xpath.SecuritySupport',
+    'javax.xml.xpath.XPath',
+    'javax.xml.xpath.XPathConstants',
+    'javax.xml.xpath.XPathException',
+    'javax.xml.xpath.XPathExpression',
+    'javax.xml.xpath.XPathExpressionException',
+    'javax.xml.xpath.XPathFactory',
+    'javax.xml.xpath.XPathFactoryConfigurationException',
+    'javax.xml.xpath.XPathFactoryFinder$1',
+    'javax.xml.xpath.XPathFactoryFinder$2',
+    'javax.xml.xpath.XPathFactoryFinder',
+    'javax.xml.xpath.XPathFunction',
+    'javax.xml.xpath.XPathFunctionException',
+    'javax.xml.xpath.XPathFunctionResolver',
+    'javax.xml.xpath.XPathVariableResolver',
+    'org.w3c.dom.Attr',
+    'org.w3c.dom.CDATASection',
+    'org.w3c.dom.CharacterData',
+    'org.w3c.dom.Comment',
+    'org.w3c.dom.DOMConfiguration',
+    'org.w3c.dom.DOMError',
+    'org.w3c.dom.DOMErrorHandler',
+    'org.w3c.dom.DOMException',
+    'org.w3c.dom.DOMImplementation',
+    'org.w3c.dom.DOMImplementationList',
+    'org.w3c.dom.DOMImplementationSource',
+    'org.w3c.dom.DOMLocator',
+    'org.w3c.dom.DOMStringList',
+    'org.w3c.dom.Document',
+    'org.w3c.dom.DocumentFragment',
+    'org.w3c.dom.DocumentType',
+    'org.w3c.dom.Element',
+    'org.w3c.dom.Entity',
+    'org.w3c.dom.EntityReference',
+    'org.w3c.dom.NameList',
+    'org.w3c.dom.NamedNodeMap',
+    'org.w3c.dom.Node',
+    'org.w3c.dom.NodeList',
+    'org.w3c.dom.Notation',
+    'org.w3c.dom.ProcessingInstruction',
+    'org.w3c.dom.Text',
+    'org.w3c.dom.TypeInfo',
+    'org.w3c.dom.UserDataHandler',
+    'org.w3c.dom.bootstrap.DOMImplementationRegistry$1',
+    'org.w3c.dom.bootstrap.DOMImplementationRegistry$2',
+    'org.w3c.dom.bootstrap.DOMImplementationRegistry$3',
+    'org.w3c.dom.bootstrap.DOMImplementationRegistry$4',
+    'org.w3c.dom.bootstrap.DOMImplementationRegistry',
+    'org.w3c.dom.css.CSS2Properties',
+    'org.w3c.dom.css.CSSCharsetRule',
+    'org.w3c.dom.css.CSSFontFaceRule',
+    'org.w3c.dom.css.CSSImportRule',
+    'org.w3c.dom.css.CSSMediaRule',
+    'org.w3c.dom.css.CSSPageRule',
+    'org.w3c.dom.css.CSSPrimitiveValue',
+    'org.w3c.dom.css.CSSRule',
+    'org.w3c.dom.css.CSSRuleList',
+    'org.w3c.dom.css.CSSStyleDeclaration',
+    'org.w3c.dom.css.CSSStyleRule',
+    'org.w3c.dom.css.CSSStyleSheet',
+    'org.w3c.dom.css.CSSUnknownRule',
+    'org.w3c.dom.css.CSSValue',
+    'org.w3c.dom.css.CSSValueList',
+    'org.w3c.dom.css.Counter',
+    'org.w3c.dom.css.DOMImplementationCSS',
+    'org.w3c.dom.css.DocumentCSS',
+    'org.w3c.dom.css.ElementCSSInlineStyle',
+    'org.w3c.dom.css.RGBColor',
+    'org.w3c.dom.css.Rect',
+    'org.w3c.dom.css.ViewCSS',
+    'org.w3c.dom.events.DocumentEvent',
+    'org.w3c.dom.events.Event',
+    'org.w3c.dom.events.EventException',
+    'org.w3c.dom.events.EventListener',
+    'org.w3c.dom.events.EventTarget',
+    'org.w3c.dom.events.MouseEvent',
+    'org.w3c.dom.events.MutationEvent',
+    'org.w3c.dom.events.UIEvent',
+    'org.w3c.dom.html.HTMLAnchorElement',
+    'org.w3c.dom.html.HTMLAppletElement',
+    'org.w3c.dom.html.HTMLAreaElement',
+    'org.w3c.dom.html.HTMLBRElement',
+    'org.w3c.dom.html.HTMLBaseElement',
+    'org.w3c.dom.html.HTMLBaseFontElement',
+    'org.w3c.dom.html.HTMLBodyElement',
+    'org.w3c.dom.html.HTMLButtonElement',
+    'org.w3c.dom.html.HTMLCollection',
+    'org.w3c.dom.html.HTMLDListElement',
+    'org.w3c.dom.html.HTMLDOMImplementation',
+    'org.w3c.dom.html.HTMLDirectoryElement',
+    'org.w3c.dom.html.HTMLDivElement',
+    'org.w3c.dom.html.HTMLDocument',
+    'org.w3c.dom.html.HTMLElement',
+    'org.w3c.dom.html.HTMLFieldSetElement',
+    'org.w3c.dom.html.HTMLFontElement',
+    'org.w3c.dom.html.HTMLFormElement',
+    'org.w3c.dom.html.HTMLFrameElement',
+    'org.w3c.dom.html.HTMLFrameSetElement',
+    'org.w3c.dom.html.HTMLHRElement',
+    'org.w3c.dom.html.HTMLHeadElement',
+    'org.w3c.dom.html.HTMLHeadingElement',
+    'org.w3c.dom.html.HTMLHtmlElement',
+    'org.w3c.dom.html.HTMLIFrameElement',
+    'org.w3c.dom.html.HTMLImageElement',
+    'org.w3c.dom.html.HTMLInputElement',
+    'org.w3c.dom.html.HTMLIsIndexElement',
+    'org.w3c.dom.html.HTMLLIElement',
+    'org.w3c.dom.html.HTMLLabelElement',
+    'org.w3c.dom.html.HTMLLegendElement',
+    'org.w3c.dom.html.HTMLLinkElement',
+    'org.w3c.dom.html.HTMLMapElement',
+    'org.w3c.dom.html.HTMLMenuElement',
+    'org.w3c.dom.html.HTMLMetaElement',
+    'org.w3c.dom.html.HTMLModElement',
+    'org.w3c.dom.html.HTMLOListElement',
+    'org.w3c.dom.html.HTMLObjectElement',
+    'org.w3c.dom.html.HTMLOptGroupElement',
+    'org.w3c.dom.html.HTMLOptionElement',
+    'org.w3c.dom.html.HTMLParagraphElement',
+    'org.w3c.dom.html.HTMLParamElement',
+    'org.w3c.dom.html.HTMLPreElement',
+    'org.w3c.dom.html.HTMLQuoteElement',
+    'org.w3c.dom.html.HTMLScriptElement',
+    'org.w3c.dom.html.HTMLSelectElement',
+    'org.w3c.dom.html.HTMLStyleElement',
+    'org.w3c.dom.html.HTMLTableCaptionElement',
+    'org.w3c.dom.html.HTMLTableCellElement',
+    'org.w3c.dom.html.HTMLTableColElement',
+    'org.w3c.dom.html.HTMLTableElement',
+    'org.w3c.dom.html.HTMLTableRowElement',
+    'org.w3c.dom.html.HTMLTableSectionElement',
+    'org.w3c.dom.html.HTMLTextAreaElement',
+    'org.w3c.dom.html.HTMLTitleElement',
+    'org.w3c.dom.html.HTMLUListElement',
+    'org.w3c.dom.ls.DOMImplementationLS',
+    'org.w3c.dom.ls.LSException',
+    'org.w3c.dom.ls.LSInput',
+    'org.w3c.dom.ls.LSLoadEvent',
+    'org.w3c.dom.ls.LSOutput',
+    'org.w3c.dom.ls.LSParser',
+    'org.w3c.dom.ls.LSParserFilter',
+    'org.w3c.dom.ls.LSProgressEvent',
+    'org.w3c.dom.ls.LSResourceResolver',
+    'org.w3c.dom.ls.LSSerializer',
+    'org.w3c.dom.ls.LSSerializerFilter',
+    'org.w3c.dom.ranges.DocumentRange',
+    'org.w3c.dom.ranges.Range',
+    'org.w3c.dom.ranges.RangeException',
+    'org.w3c.dom.stylesheets.DocumentStyle',
+    'org.w3c.dom.stylesheets.LinkStyle',
+    'org.w3c.dom.stylesheets.MediaList',
+    'org.w3c.dom.stylesheets.StyleSheet',
+    'org.w3c.dom.stylesheets.StyleSheetList',
+    'org.w3c.dom.traversal.DocumentTraversal',
+    'org.w3c.dom.traversal.NodeFilter',
+    'org.w3c.dom.traversal.NodeIterator',
+    'org.w3c.dom.traversal.TreeWalker',
+    'org.w3c.dom.views.AbstractView',
+    'org.w3c.dom.views.DocumentView',
+    'org.w3c.dom.xpath.XPathEvaluator',
+    'org.w3c.dom.xpath.XPathException',
+    'org.w3c.dom.xpath.XPathExpression',
+    'org.w3c.dom.xpath.XPathNSResolver',
+    'org.w3c.dom.xpath.XPathNamespace',
+    'org.w3c.dom.xpath.XPathResult',
+    'org.xml.sax.AttributeList',
+    'org.xml.sax.Attributes',
+    'org.xml.sax.ContentHandler',
+    'org.xml.sax.DTDHandler',
+    'org.xml.sax.DocumentHandler',
+    'org.xml.sax.EntityResolver',
+    'org.xml.sax.ErrorHandler',
+    'org.xml.sax.HandlerBase',
+    'org.xml.sax.InputSource',
+    'org.xml.sax.Locator',
+    'org.xml.sax.Parser',
+    'org.xml.sax.SAXException',
+    'org.xml.sax.SAXNotRecognizedException',
+    'org.xml.sax.SAXNotSupportedException',
+    'org.xml.sax.SAXParseException',
+    'org.xml.sax.XMLFilter',
+    'org.xml.sax.XMLReader',
+    'org.xml.sax.ext.Attributes2',
+    'org.xml.sax.ext.Attributes2Impl',
+    'org.xml.sax.ext.DeclHandler',
+    'org.xml.sax.ext.DefaultHandler2',
+    'org.xml.sax.ext.EntityResolver2',
+    'org.xml.sax.ext.LexicalHandler',
+    'org.xml.sax.ext.Locator2',
+    'org.xml.sax.ext.Locator2Impl',
+    'org.xml.sax.helpers.AttributeListImpl',
+    'org.xml.sax.helpers.AttributesImpl',
+    'org.xml.sax.helpers.DefaultHandler',
+    'org.xml.sax.helpers.LocatorImpl',
+    'org.xml.sax.helpers.NamespaceSupport$Context',
+    'org.xml.sax.helpers.NamespaceSupport',
+    'org.xml.sax.helpers.NewInstance',
+    'org.xml.sax.helpers.ParserAdapter$AttributeListAdapter',
+    'org.xml.sax.helpers.ParserAdapter',
+    'org.xml.sax.helpers.ParserFactory',
+    'org.xml.sax.helpers.SecuritySupport$1',
+    'org.xml.sax.helpers.SecuritySupport$2',
+    'org.xml.sax.helpers.SecuritySupport$3',
+    'org.xml.sax.helpers.SecuritySupport$4',
+    'org.xml.sax.helpers.SecuritySupport',
+    'org.xml.sax.helpers.XMLFilterImpl',
+    'org.xml.sax.helpers.XMLReaderAdapter$AttributesAdapter',
+    'org.xml.sax.helpers.XMLReaderAdapter',
+    'org.xml.sax.helpers.XMLReaderFactory',
 ]

plugins/mapper-attachments/build.gradle

@@ -55,7 +55,6 @@ dependencies {
   compile "org.apache.poi:poi-ooxml-schemas:${versions.poi}"
   compile "commons-codec:commons-codec:${versions.commonscodec}"
   compile 'org.apache.xmlbeans:xmlbeans:2.6.0'
-  compile 'stax:stax-api:1.0.1'
   // MS Office
   compile "org.apache.poi:poi-scratchpad:${versions.poi}"
   // Apple iWork
@@ -71,7 +70,7 @@ forbiddenPatterns {
 }
 
 // classes are missing, e.g. org.openxmlformats.schemas.drawingml.x2006.chart.CTExtensionList
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 thirdPartyAudit.excludes = [
     // uses internal java api: com.sun.syndication (SyndFeedInput, SyndFeed, SyndEntry, SyndContent)
     'org.apache.tika.parser.feed.FeedParser',

plugins/mapper-attachments/licenses/stax-api-1.0.1.jar.sha1

@@ -1 +0,0 @@
-49c100caf72d658aca8e58bd74a4ba90fa2b0d70

plugins/mapper-attachments/licenses/stax-api-LICENSE.txt

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

plugins/repository-hdfs/build.gradle

@@ -203,4 +203,4 @@ integTest {
 }
 
 // classes are missing, e.g. org.mockito.Mockito
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true

plugins/repository-s3/build.gradle

@@ -51,7 +51,7 @@ test {
 }
 
 // classes are missing, e.g. org.apache.log.Logger
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 thirdPartyAudit.excludes = [
     // uses internal java api: com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl
     // uses internal java api: com.sun.org.apache.xml.internal.dtm.ref.DTMManagerDefault

qa/evil-tests/build.gradle

@@ -36,7 +36,7 @@ test {
 }
 
 // classes are missing, com.ibm.icu.lang.UCharacter
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true
 thirdPartyAudit.excludes = [
     // uses internal java api: sun.misc.Unsafe
     'com.google.common.cache.Striped64',

test-framework/build.gradle

@@ -48,4 +48,4 @@ forbiddenApisMain {
 dependencyLicenses.enabled = false
 
 // we intentionally exclude the ant tasks because people were depending on them from their tests!!!!!!!
-thirdPartyAudit.lenient = true
+thirdPartyAudit.missingClasses = true