From f37b820c32c86ab4d4242ffc1e4c69c5bc247e90 Mon Sep 17 00:00:00 2001
From: Han-Wen Nienhuys <hanwen@google.com>
Date: Wed, 17 Apr 2019 17:19:55 +0200
Subject: [PATCH 1/2] tools/nongoogle.bzl: separate out dependencies exempt
 from library compliance

Change-Id: I4b96d0cd5277371bb484118cb94c5f6e6b47c3b4
---
 WORKSPACE           |  8 ++------
 tools/nongoogle.bzl | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 6 deletions(-)
 create mode 100644 tools/nongoogle.bzl

diff --git a/WORKSPACE b/WORKSPACE
index 198816cb8b..d07fb2aeb8 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -5,6 +5,7 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file"
 load("//tools/bzl:maven_jar.bzl", "GERRIT", "MAVEN_LOCAL", "maven_jar")
 load("//lib/codemirror:cm.bzl", "CM_VERSION", "DIFF_MATCH_PATCH_VERSION")
 load("//plugins:external_plugin_deps.bzl", "external_plugin_deps")
+load("//tools:nongoogle.bzl", "declare_nongoogle_deps")
 
 http_archive(
     name = "bazel_skylib",
@@ -646,12 +647,7 @@ maven_jar(
     sha1 = "ed193d86e0af90cc2342aedbe73c5d86b03fa09b",
 )
 
-# Transitive dependency of commons-compress
-maven_jar(
-    name = "tukaani-xz",
-    artifact = "org.tukaani:xz:1.6",
-    sha1 = "05b6f921f1810bdf90e25471968f741f87168b64",
-)
+declare_nongoogle_deps()
 
 LUCENE_VERS = "6.6.5"
 
diff --git a/tools/nongoogle.bzl b/tools/nongoogle.bzl
new file mode 100644
index 0000000000..047469e292
--- /dev/null
+++ b/tools/nongoogle.bzl
@@ -0,0 +1,14 @@
+load("//tools/bzl:maven_jar.bzl", "GERRIT", "MAVEN_LOCAL", "maven_jar")
+
+def declare_nongoogle_deps():
+    """loads dependencies that are not used at Google.
+
+    These are exempt from library compliance review.
+    """
+
+    # Transitive dependency of commons-compress
+    maven_jar(
+        name = "tukaani-xz",
+        artifact = "org.tukaani:xz:1.6",
+        sha1 = "05b6f921f1810bdf90e25471968f741f87168b64",
+    )

From 88868493151df3d78cd7153b4a2ecf764619b073 Mon Sep 17 00:00:00 2001
From: Han-Wen Nienhuys <hanwen@google.com>
Date: Thu, 25 Apr 2019 12:15:41 +0200
Subject: [PATCH 2/2] lib: check that nongoogle.bzl doesn't grow new
 dependencies

Change-Id: Ie5fbd18de68fca13f954ef4d05ea7acc7d9cfea9
---
 lib/BUILD             |  6 ++++++
 lib/nongoogle_test.sh | 17 +++++++++++++++++
 tools/BUILD           |  2 ++
 tools/nongoogle.bzl   |  6 ++++--
 4 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100755 lib/nongoogle_test.sh

diff --git a/lib/BUILD b/lib/BUILD
index 95ca4db461..b3c149a72b 100644
--- a/lib/BUILD
+++ b/lib/BUILD
@@ -504,3 +504,9 @@ java_library(
     visibility = ["//visibility:public"],
     exports = ["@postgresql//jar"],
 )
+
+sh_test(
+    name = "nongoogle_test",
+    srcs = ["nongoogle_test.sh"],
+    data = ["//tools:nongoogle.bzl"],
+)
diff --git a/lib/nongoogle_test.sh b/lib/nongoogle_test.sh
new file mode 100755
index 0000000000..23b40add7e
--- /dev/null
+++ b/lib/nongoogle_test.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# This test ensures that new dependencies in nongoogle.bzl go through LC review.
+
+set -eux
+
+bzl=$(pwd)/tools/nongoogle.bzl
+
+TMP=$(mktemp -d || mktemp -d -t /tmp/tmp.XXXXXX)
+
+grep 'name = "[^"]*"' ${bzl} | sed 's|^[^"]*"||g;s|".*$||g' | sort > $TMP/names
+
+cat << EOF > $TMP/want
+tukaani-xz
+EOF
+
+diff -u $TMP/names $TMP/want
diff --git a/tools/BUILD b/tools/BUILD
index aefb867277..d4ab2a8c02 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -4,6 +4,8 @@ load(
     "default_java_toolchain",
 )
 
+exports_files(["nongoogle.bzl"])
+
 py_binary(
     name = "merge_jars",
     srcs = ["merge_jars.py"],
diff --git a/tools/nongoogle.bzl b/tools/nongoogle.bzl
index 047469e292..2e84717abb 100644
--- a/tools/nongoogle.bzl
+++ b/tools/nongoogle.bzl
@@ -1,9 +1,11 @@
-load("//tools/bzl:maven_jar.bzl", "GERRIT", "MAVEN_LOCAL", "maven_jar")
+load("//tools/bzl:maven_jar.bzl", "maven_jar")
 
 def declare_nongoogle_deps():
     """loads dependencies that are not used at Google.
 
-    These are exempt from library compliance review.
+    Changes to versions are exempt from library compliance review. New
+    dependencies must pass through library compliance review. This is
+    enforced by //lib:nongoogle_test.
     """
 
     # Transitive dependency of commons-compress