Upgrade forbiddenapis to 2.6 (#33809)

* Upgrade forbiddenapis to 2.6

Closes #33759

* Switch forbiddenApis back to official plugin

* Remove CLI based task

* Fix forbiddenApisJava9

buildSrc/build.gradle

@@ -106,6 +106,7 @@ dependencies {
   compile 'org.apache.rat:apache-rat:0.11'
   compile "org.elasticsearch:jna:4.5.1"
   compile 'com.github.jengelman.gradle.plugins:shadow:2.0.4'
+  compile 'de.thetaphi:forbiddenapis:2.6'
   testCompile "junit:junit:${props.getProperty('junit')}"
 }
 

buildSrc/src/main/groovy/org/elasticsearch/gradle/precommit/PrecommitTasks.groovy

@@ -19,7 +19,10 @@
 package org.elasticsearch.gradle.precommit
 
 import com.github.jengelman.gradle.plugins.shadow.ShadowPlugin
+import de.thetaphi.forbiddenapis.gradle.CheckForbiddenApis
+import de.thetaphi.forbiddenapis.gradle.ForbiddenApisPlugin
 import org.elasticsearch.gradle.ExportElasticsearchBuildResourcesTask
+import org.gradle.api.JavaVersion
 import org.gradle.api.Project
 import org.gradle.api.Task
 import org.gradle.api.plugins.JavaBasePlugin
@@ -33,7 +36,7 @@ class PrecommitTasks {
     public static Task create(Project project, boolean includeDependencyLicenses) {
         project.configurations.create("forbiddenApisCliJar")
         project.dependencies {
-            forbiddenApisCliJar ('de.thetaphi:forbiddenapis:2.5')
+            forbiddenApisCliJar ('de.thetaphi:forbiddenapis:2.6')
         }
 
         List<Task> precommitTasks = [
@@ -109,47 +112,43 @@ class PrecommitTasks {
     }
 
     private static Task configureForbiddenApisCli(Project project) {
-        Task forbiddenApisCli = project.tasks.create('forbiddenApis')
+        project.pluginManager.apply(ForbiddenApisPlugin)
-        project.sourceSets.all { sourceSet ->
+        ExportElasticsearchBuildResourcesTask buildResources = project.tasks.getByName('buildResources')
-            forbiddenApisCli.dependsOn(
+        project.tasks.withType(CheckForbiddenApis) {
-                project.tasks.create(sourceSet.getTaskName('forbiddenApis', null), ForbiddenApisCliTask) {
+            dependsOn(buildResources)
-                    ExportElasticsearchBuildResourcesTask buildResources = project.tasks.getByName('buildResources')
+            targetCompatibility = project.runtimeJavaVersion >= JavaVersion.VERSION_1_9 ?
-                    dependsOn(buildResources)
+                    project.runtimeJavaVersion.getMajorVersion() :
-                    it.sourceSet = sourceSet
+                    project.runtimeJavaVersion
-                    javaHome = project.runtimeJavaHome
+            bundledSignatures = [
-                    targetCompatibility = project.compilerJavaVersion
+                    "jdk-unsafe", "jdk-deprecated", "jdk-non-portable", "jdk-system-out"
-                    bundledSignatures = [
+            ]
-                       "jdk-unsafe", "jdk-deprecated", "jdk-non-portable", "jdk-system-out"
+            signaturesFiles = project.files(
-                    ]
+                    buildResources.copy("forbidden/jdk-signatures.txt"),
-                    signaturesFiles = project.files(
+                    buildResources.copy("forbidden/es-all-signatures.txt")
-                            buildResources.copy("forbidden/jdk-signatures.txt"),
-                            buildResources.copy("forbidden/es-all-signatures.txt")
-                    )
-                    suppressAnnotations = ['**.SuppressForbidden']
-                    if (sourceSet.name == 'test') {
-                        signaturesFiles += project.files(
-                                buildResources.copy("forbidden/es-test-signatures.txt"),
-                                buildResources.copy("forbidden/http-signatures.txt")
-                        )
-                    } else {
-                        signaturesFiles += project.files(buildResources.copy("forbidden/es-server-signatures.txt"))
-                    }
-                    dependsOn sourceSet.classesTaskName
-                    classesDirs = sourceSet.output.classesDirs
-                    ext.replaceSignatureFiles = { String... names ->
-                        signaturesFiles = project.files(
-                                names.collect { buildResources.copy("forbidden/${it}.txt") }
-                        )
-                    }
-                    ext.addSignatureFiles = { String... names ->
-                        signaturesFiles += project.files(
-                                names.collect { buildResources.copy("forbidden/${it}.txt") }
-                        )
-                    }
-                }
             )
+            suppressAnnotations = ['**.SuppressForbidden']
+            if (name.endsWith('Test')) {
+                signaturesFiles += project.files(
+                        buildResources.copy("forbidden/es-test-signatures.txt"),
+                        buildResources.copy("forbidden/http-signatures.txt")
+                )
+            } else {
+                signaturesFiles += project.files(buildResources.copy("forbidden/es-server-signatures.txt"))
+            }
+            ext.replaceSignatureFiles = { String... names ->
+                signaturesFiles = project.files(
+                        names.collect { buildResources.copy("forbidden/${it}.txt") }
+                )
+            }
+            ext.addSignatureFiles = { String... names ->
+                signaturesFiles += project.files(
+                        names.collect { buildResources.copy("forbidden/${it}.txt") }
+                )
+            }
         }
-        return forbiddenApisCli
+        Task forbiddenApis =  project.tasks.getByName("forbiddenApis")
+        forbiddenApis.group = ""
+        return forbiddenApis
     }
 
     private static Task configureCheckstyle(Project project) {

buildSrc/src/main/java/org/elasticsearch/gradle/precommit/ForbiddenApisCliTask.java

@@ -1,177 +0,0 @@
-/*
- * Licensed to Elasticsearch under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.elasticsearch.gradle.precommit;
-
-import org.elasticsearch.gradle.LoggedExec;
-import org.gradle.api.JavaVersion;
-import org.gradle.api.artifacts.Configuration;
-import org.gradle.api.file.FileCollection;
-import org.gradle.api.logging.Logger;
-import org.gradle.api.logging.Logging;
-import org.gradle.api.tasks.Input;
-import org.gradle.api.tasks.InputFiles;
-import org.gradle.api.tasks.SkipWhenEmpty;
-import org.gradle.api.tasks.SourceSet;
-import org.gradle.api.tasks.TaskAction;
-import org.gradle.process.JavaExecSpec;
-
-import java.io.File;
-import java.util.ArrayList;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Set;
-
-public class ForbiddenApisCliTask extends PrecommitTask {
-
-    private final Logger logger = Logging.getLogger(ForbiddenApisCliTask.class);
-    private FileCollection signaturesFiles;
-    private List<String> signatures = new ArrayList<>();
-    private Set<String> bundledSignatures = new LinkedHashSet<>();
-    private Set<String> suppressAnnotations = new LinkedHashSet<>();
-    private JavaVersion targetCompatibility;
-    private FileCollection classesDirs;
-    private SourceSet sourceSet;
-    // This needs to be an object so it can hold Groovy GStrings
-    private Object javaHome;
-
-    @Input
-    public JavaVersion getTargetCompatibility() {
-        return targetCompatibility;
-    }
-
-    public void setTargetCompatibility(JavaVersion targetCompatibility) {
-        if (targetCompatibility.compareTo(JavaVersion.VERSION_1_10) > 0) {
-            logger.warn(
-                "Target compatibility is set to {} but forbiddenapis only supports up to 10. Will cap at 10.",
-                targetCompatibility
-            );
-            this.targetCompatibility = JavaVersion.VERSION_1_10;
-        } else {
-            this.targetCompatibility = targetCompatibility;
-        }
-    }
-
-    @InputFiles
-    @SkipWhenEmpty
-    public FileCollection getClassesDirs() {
-        return classesDirs.filter(File::exists);
-    }
-
-    public void setClassesDirs(FileCollection classesDirs) {
-        this.classesDirs = classesDirs;
-    }
-
-    @InputFiles
-    public FileCollection getSignaturesFiles() {
-        return signaturesFiles;
-    }
-
-    public void setSignaturesFiles(FileCollection signaturesFiles) {
-        this.signaturesFiles = signaturesFiles;
-    }
-
-    @Input
-    public List<String> getSignatures() {
-        return signatures;
-    }
-
-    public void setSignatures(List<String> signatures) {
-        this.signatures = signatures;
-    }
-
-    @Input
-    public Set<String> getBundledSignatures() {
-        return bundledSignatures;
-    }
-
-    public void setBundledSignatures(Set<String> bundledSignatures) {
-        this.bundledSignatures = bundledSignatures;
-    }
-
-    @Input
-    public Set<String> getSuppressAnnotations() {
-        return suppressAnnotations;
-    }
-
-    public void setSuppressAnnotations(Set<String> suppressAnnotations) {
-        this.suppressAnnotations = suppressAnnotations;
-    }
-
-    @InputFiles
-    public FileCollection getClassPathFromSourceSet() {
-        return getProject().files(
-            sourceSet.getCompileClasspath(),
-            sourceSet.getRuntimeClasspath()
-        );
-    }
-
-    public void setSourceSet(SourceSet sourceSet) {
-        this.sourceSet = sourceSet;
-    }
-
-    @InputFiles
-    public Configuration getForbiddenAPIsConfiguration() {
-        return getProject().getConfigurations().getByName("forbiddenApisCliJar");
-    }
-
-    @Input
-    public Object getJavaHome() {
-        return javaHome;
-    }
-
-    public void setJavaHome(Object javaHome) {
-        this.javaHome = javaHome;
-    }
-
-    @TaskAction
-    public void runForbiddenApisAndWriteMarker() {
-        LoggedExec.javaexec(getProject(), (JavaExecSpec spec) -> {
-            spec.classpath(
-                getForbiddenAPIsConfiguration(),
-                getClassPathFromSourceSet()
-            );
-            spec.setExecutable(getJavaHome() + "/bin/java");
-            spec.setMain("de.thetaphi.forbiddenapis.cli.CliMain");
-            // build the command line
-            getSignaturesFiles().forEach(file -> spec.args("-f", file.getAbsolutePath()));
-            getSuppressAnnotations().forEach(annotation -> spec.args("--suppressannotation", annotation));
-            getBundledSignatures().forEach(bundled -> {
-                    // there's no option for target compatibility so we have to interpret it
-                    final String prefix;
-                    if (bundled.equals("jdk-system-out") ||
-                        bundled.equals("jdk-reflection") ||
-                        bundled.equals("jdk-non-portable")) {
-                        prefix = "";
-                    } else {
-                        prefix = "-" + (
-                            getTargetCompatibility().compareTo(JavaVersion.VERSION_1_9) >= 0 ?
-                                getTargetCompatibility().getMajorVersion() :
-                                "1." + getTargetCompatibility().getMajorVersion())
-                        ;
-                    }
-                    spec.args("-b", bundled + prefix);
-                }
-            );
-            getClassesDirs().forEach(dir ->
-                spec.args("-d", dir)
-            );
-        });
-    }
-
-}

buildSrc/src/main/java/org/elasticsearch/gradle/precommit/ThirdPartyAuditTask.java

@@ -52,7 +52,7 @@ import java.util.stream.IntStream;
 public class ThirdPartyAuditTask extends DefaultTask {
 
     private static final Pattern MISSING_CLASS_PATTERN = Pattern.compile(
-        "WARNING: The referenced class '(.*)' cannot be loaded\\. Please fix the classpath!"
+        "WARNING: Class '(.*)' cannot be loaded \\(.*\\)\\. Please fix the classpath!"
     );
 
     private static final Pattern VIOLATION_PATTERN = Pattern.compile(

client/rest/build.gradle

@@ -1,4 +1,4 @@
-import org.elasticsearch.gradle.precommit.ForbiddenApisCliTask
+import de.thetaphi.forbiddenapis.gradle.CheckForbiddenApis
 
 /*
  * Licensed to Elasticsearch under one or more contributor
@@ -52,7 +52,7 @@ dependencies {
   testCompile "org.elasticsearch:mocksocket:${versions.mocksocket}"
 }
 
-tasks.withType(ForbiddenApisCliTask) {
+tasks.withType(CheckForbiddenApis) {
   //client does not depend on server, so only jdk and http signatures should be checked
   replaceSignatureFiles ('jdk-signatures', 'http-signatures')
 }

distribution/tools/launchers/build.gradle

@@ -16,10 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
+import de.thetaphi.forbiddenapis.gradle.CheckForbiddenApis
-
-
-import org.elasticsearch.gradle.precommit.ForbiddenApisCliTask
 
 apply plugin: 'elasticsearch.build'
 
@@ -32,7 +29,7 @@ dependencies {
 
 archivesBaseName = 'elasticsearch-launchers'
 
-tasks.withType(ForbiddenApisCliTask) {
+tasks.withType(CheckForbiddenApis) {
     replaceSignatureFiles 'jdk-signatures'
 }
 

libs/core/build.gradle

@@ -48,8 +48,7 @@ if (!isEclipse && !isIdea) {
 
     forbiddenApisJava9 {
         if (project.runtimeJavaVersion < JavaVersion.VERSION_1_9) {
-            targetCompatibility = JavaVersion.VERSION_1_9
+            targetCompatibility = JavaVersion.VERSION_1_9.getMajorVersion()
-            javaHome = project.java9Home
         }
         replaceSignatureFiles 'jdk-signatures'
     }

plugins/analysis-icu/build.gradle

@@ -1,4 +1,4 @@
-import org.elasticsearch.gradle.precommit.ForbiddenApisCliTask
+import de.thetaphi.forbiddenapis.gradle.CheckForbiddenApis
 
 /*
  * Licensed to Elasticsearch under one or more contributor
@@ -25,7 +25,7 @@ esplugin {
   hasClientJar = true
 }
 
-tasks.withType(ForbiddenApisCliTask) {
+tasks.withType(CheckForbiddenApis) {
   signatures += [
     "com.ibm.icu.text.Collator#getInstance() @ Don't use default locale, use getInstance(ULocale) instead"
   ]

server/build.gradle

@@ -61,8 +61,7 @@ if (!isEclipse && !isIdea) {
 
   forbiddenApisJava9 {
     if (project.runtimeJavaVersion < JavaVersion.VERSION_1_9) {
-      targetCompatibility = JavaVersion.VERSION_1_9
+      targetCompatibility = JavaVersion.VERSION_1_9.getMajorVersion()
-      javaHome = project.java9Home
     }
   }
 

x-pack/plugin/security/cli/build.gradle

@@ -1,4 +1,4 @@
-import org.elasticsearch.gradle.precommit.ForbiddenApisCliTask
+import de.thetaphi.forbiddenapis.gradle.CheckForbiddenApis
 
 apply plugin: 'elasticsearch.build'
 
@@ -26,7 +26,7 @@ if (project.inFipsJvm) {
     test.enabled = false
     // Forbiden APIs non-portable checks fail because bouncy castle classes being used from the FIPS JDK since those are
     // not part of the Java specification - all of this is as designed, so we have to relax this check for FIPS.
-    tasks.withType(ForbiddenApisCliTask) {
+    tasks.withType(CheckForbiddenApis) {
         bundledSignatures -= "jdk-non-portable"
     }
     // FIPS JVM includes manny classes from bouncycastle which count as jar hell for the third party audit,

x-pack/plugin/sql/sql-cli/build.gradle

@@ -1,4 +1,4 @@
-import org.elasticsearch.gradle.precommit.ForbiddenApisCliTask
+import de.thetaphi.forbiddenapis.gradle.CheckForbiddenApis
 
 /*
  * This project is named sql-cli because it is in the "org.elasticsearch.plugin"
@@ -75,7 +75,7 @@ artifacts  {
 }
 
 
-tasks.withType(ForbiddenApisCliTask) {
+tasks.withType(CheckForbiddenApis) {
     signaturesFiles += files('src/forbidden/cli-signatures.txt')
 }