Change-Id: Ib2bbdef1e1ede55115d1526b6699e905623c36a5
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ie220dd95fae18f894e2a04a5ae6d29a1e5a6d76b
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I583bf7d60bccc876156be1f605bfda32b89cd08b
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I4f5dda6da3f6ecd9b99c1d9a220844c5402f1988
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I85dab173a94b3036ccf669c20b9dffb4af0922b4
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ib9042662c3f2a1544d597d476c5952c61767687b
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I9e8e74a10dbb235b08c6a5e1b169c5cae440f129
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ie8d2b60be1803399027e1a3e9734625278a63861
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I13488a915fe0ba871c5f37c6e9efc6f436083171
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ie4d17e1604270946606e75145012c5b7fa1283eb
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I1ded7a2b61235509c5a6ba95e7329e288bbfddb1
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: If8e8ca20e745901a5e0239c16cb4acc7934b4ec8
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I3d06c5237edae54b09f465f415f5a308b5e7ceff
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I0b53f95ee51d94da8b029c9bb10eb854ff9dd4f6
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: If57fcce14f5ba3ef2a2602515e2f89b8f22a742b
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I545095f9ee7481c73765d029f9a32edf01625893
Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>

Change-Id: Ie86c46a828b55a2235056b9a5bc2c6c450b95ed0
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Id84497107ef9ee2eca3c9d65197ab8c14f492655
Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>

Change-Id: I1d2ad0536a0fd02361e17d0175eaeca2c047660c
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Update
- org.apache.httpcomponents.httpclient to 4.5.5.v20180409-1525
- org.apache.httpcomponents.httpcore to 4.4.9.v20180409-1525

CQ: 16959
CQ: 16960
Change-Id: I11f2979e1c39fe26421693a7c694e51c471326a0
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Iae9d763a65481b09af6e19b33e41375f27038357
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Iccb98c03a069fee85a52325e1ed22cba8b76bcd8
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I02630900ab131478b30abe68b2133d2c8a5a67ab
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ic58a916d7e2c380b84690afa5e3517c6c178af8c
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ibb2ee9d00d5d049f681e1abbb449656105e553a7
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I3f4f437649736c6a27e78d536344c7b31c8a0f65
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I5c437f45d5bc469e3c32bef1180c127d96d24d23
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I0d8c7ca756e6236e315c91da000fe8103ce83d05
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Any additional statements after the statement that is expected to
throw will never be executed in a passing test. This can lead to
inappropriately passing tests where later incorrect assertions are
skipped by the thrown exception. See [1] for examples.

There are no cases of this in the code base, but by enabling the
checker with severity ERROR we can ensure that we don't overlook
any future misuse of ExpectedException.

[1] http://errorprone.info/bugpattern/ExpectedExceptionChecker

Change-Id: I266d4f73f6075bfc1e39fa3d8aee7dee96db61b9
Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>

Change-Id: I00e255adb3e14f4046f7eeb4fcc2a344bb7bda9d
Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>

Change-Id: I65e83f39a4082278c4cb809dbb08d44a119cebe0
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I594cd85d46698953c27da3687e4ec40aeb73b445
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I290d9c4a27d2ca1b9071f39639195e0d85799c00
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

The same errors are suppressed when generating javadoc.
Suppress the errors during site generation.

Change-Id: I83bd1c10e5de82f47c351e7edf2c9230be4b1f21
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

- build-helper-maven-plugin 3.0.0
- eclipse-jarsigner-plugin 1.1.5
- jacoco-maven-plugin 0.8.1
- maven-clean-plugin 3.1.0
- maven-jar-plugin 3.1.2
- maven-pmd-plugin 3.10.0
- maven-resources-plugin 3.1.0
- maven-shade-plugin 3.1.1
- maven-site-plugin 3.7.1
- maven-surefire-plugin 2.21.0
- maven-surefire-report-plugin 2.21.0
- plexus-compiler-javac 2.8.4
- spotbugs-maven-plugin 3.1.3.1
- tycho 1.2.0 (leftover)
- wagon-ssh 3.1.0

Change-Id: I8eba2ee448437a775542ef6a7c59661727aa207c
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Iadf12dbdd63ef17c3f712c0fc18495304aa35016
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ia2d548676217250593c3f0c383aec19e12e5e4a4
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Iedccfcaf57c11822f1faf5d5195357de42b2a14e
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Zip Slip [1] is an arbitrary file write generic vulnerability, that can
be achieved using a specially crafted zip (or bzip2, gzip, tar, xz, war)
archive, that holds path traversal filenames.

According to Maven's announcement [2] several plugins use plexus-archiver to
unpack dependencies to disk and have been identified as potential triggers
for exposing the vulnerability.

Of those, JGit uses the maven-dependency-plugin and the maven-javadoc-plugin.

Update them to the fixed versions reported in [2].

See the corresponding issues for the maven-dependency-plugin [3] and the
maven-javadoc-plugin [4] for details.

[1] https://snyk.io/research/zip-slip-vulnerability
[2] https://maven.apache.org/security-plexus-archiver.html
[3] https://issues.apache.org/jira/browse/MDEP-611
[4] https://issues.apache.org/jira/browse/MJAVADOC-520

Change-Id: Id3ab2d6161db240f2ab8f82298fa3ecd7a930a43
Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>

Change-Id: I9acca328146aa7100fbc1b457fcb1f8fd87cf52a
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ic7a6a87dd3a21351e60fbf6cd330456adf1f6800
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I9c4a0465f8e85041d24da97f4b4c7ad5f5eed3e4
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ifad678794525c01838b03e52bada66e1c089c5ae
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I8523a993ae1f7b62573d7547273bc1356bf64fa7
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ie343ccf37f46168041046500a2e19acc80814cfe
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: Ie2c35fab87f294b00f9754b07b60a848bf256b10
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I65d7d74c6124507aa9cb2856c74db6a1a6935bab
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Change-Id: I42eb046c8ac8537672010aabe21459293cb23838
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

Found instructions for configuring maven-compiler-plugin with ecj in
[1]. Verified that ecj run in this way raises build errors when executed
on commit d3ef5213.

Define profiles "ecj" for using Eclipse compiler and "javac" for using
javac including errorprone. By default ecj will be used.

use ecj:
$ mvn -Pecj clean install

use javac:
$ mvn -Pjavac clean install

TODO: find out how to run ecj with errorprone from Maven.

[1] https://stackoverflow.com/questions/33164976/using-eclipse-java-compiler-ecj-in-maven-builds

Change-Id: I716b603b57612b953e603387c82fd01eb1b5ca97
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>

and plexus-compiler-javac-errorprone to 2.8.4.

Change-Id: I36487ce53e70b54d7a04292e666540224c107b43
Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>