The gpg-agent stores secret keys in individual files in the secret
key directory private-keys-v1.d. The files have the key's keygrip
(in upper case) as name and extension ".key".

A keygrip is a SHA1 hash over the parameters of the public key. By
computing this keygrip, we can pre-compute the expected file name and
then check only that one file instead of having to iterate over all
keys stored in that directory.

This file naming scheme is actually an implementation detail of
gpg-agent. It is unlikely to change, though. The keygrip itself is
computed via libgcrypt and will remain stable according to the GPG
main author.[1]

Add an implementation for calculating the keygrip and include tests.
Do not iterate over files in BouncyCastleGpgKeyLocator but only check
the single file identified by the keygrip.

Ideally upstream BouncyCastle would provide such a getKeyGrip() method.
But as it re-builds GPG and libgcrypt internals, it's doubtful it would
be included there, and since BouncyCastle even lacks a number of curve
OIDs for ed25519/curve25519 and uses the short-Weierstrass parameters
instead of the more common Montgomery parameters, including it there
might be quite a bit of work.

[1] http://gnupg.10057.n7.nabble.com/GnuPG-2-1-x-and-2-2-x-keyring-formats-tp54146p54154.html

Bug: 547536
Change-Id: I30022a0e7b33b1bf35aec1222f84591f0c30ddfd
Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>

Motivation: BouncyCastle serves as 'default' implementation of
the GPG Signer. If a client application does not use it there is no need
to pull in this dependency, especially since BouncyCastle is a large
library.

Move the classes depending on BouncyCastle to an OSGi fragment extending
the org.eclipse.jgit bundle. They are moved to a distinct internal
package in order to avoid split packages. This doesn't break public API
since these classes were already in an internal package before this
change.

Add a new feature org.eclipse.jgit.gpg.bc to enable installation. With
that users can now decide if they want to install it.

Attempts to sign a commit if org.eclipse.jgit.gpg.bc isn't available
will result in ServiceUnavailableException being thrown.

Bug: 559106
Change-Id: I42fd6c00002e17aa9a7be96ae434b538ea86ccf8
Also-by: Michael Dardis <git@md-5.net>
Signed-off-by: Michael Dardis <git@md-5.net>
Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
Signed-off-by: David Ostrovsky <david@ostrovsky.org>

This is a simple HTTP server that provides the minimum server side
support required for dumb (non-git aware) transport clients.

We produce the info/refs and objects/info/packs file on the fly
from the local repository state, but otherwise serve data as raw
files from the on-disk structure.

In the future we could better optimize the FileSender class and the
servlets that use it to take advantage of direct file to network
APIs in more advanced servlet containers like Jetty.

Our glue package borrows the idea of a micro embedded DSL from
Google Guice and uses it to configure a collection of Filters
and HttpServlets, all of which are matched against requests using
regular expressions.  If a subgroup exists in the pattern, it is
extracted and used for the path info component of the request.

Change-Id: Ia0f1a425d07d035e344ae54faf8aeb04763e7487
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>

Since Robin reverted using the maven-bundle-plugin to produce the
OSGi manifest, there is no reason for us to reference it from our
build process anymore.

Also, when Robin reverted the to the Eclipse way of doing things,
we failed to update the ignore files to ignore our generated files
but not ignore our tracked .classpath.

Finally, we cannot delete the MANIFEST.MF file during a Maven build,
as this is once again a source file.

Change-Id: I53f77f2002cb4285f728968829560e835651e188
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>

Tycho isn't production ready for projects like JGit to be using as
their primary build driver.  Some problems we ran into with Tycho
0.6.0 that are preventing us from using it are:

 * Tycho can't run offline

   The P2 artifact resolver cannot perform its work offline.  If the
   build system has no network connection, it cannot compile a
   project through Tycho.  This is insane for a distributed version
   control system where developers are used to being offline during
   development and local testing.

 * Magic state in ~/.m2/repository/.meta/p2-metadata.properties

   Earlier iterations of this patch tried to use a hybrid build,
   where Tycho was only used for the Eclipse specific feature and P2
   update site, and maven-bundle-plugin was used for the other code.
   This build seemed to work, but only due to magic Tycho specific
   state held in my local home directory.  This means builds are not
   consistently repeatable across systems, and lead me to believe
   I had a valid build, when in fact I did not.

 * Manifest-first build produces incomplete POMs

   The POM created by the manifest-first build format does not
   contain the dependency chain, leading a downstream consumer to
   not import the runtime dependencies necessary to execute the
   bundle it has imported.  In JGit's case, this means JSch isn't
   included in our dependency chain.

 * Manifest-first build produces POMs unreadable by Maven 2.x

   JGit has existing application consumers who are relying on
   Maven 2.x builds.  Forcing them to step up to an alpha release
   of Maven 3 is simply unacceptable.

 * OSGi bundle export data management is tedious

   Editing each of our pom.xml files to mark a new release is
   difficult enough as it is.  Editing every MANIFEST.MF file to
   list our exported packages and their current version number is
   something a machine should do, not a human.  Yet the Tycho OSGi
   way unfortunately demands that a human do this work.

 * OSGi bundle import data management is tedious

   There isn't a way in the MANIFEST.MF file format to reuse the
   same version tags across all of our imports, but we want to have
   a consistent view of our dependencies when we compile JGit.

After wasting more than 2 full days trying to get Tycho to work,
I've decided its a lost cause right now.  We need to be chasing down
bugs and critical features, not trying to bridge the gap between
the stable Maven repository format and the undocumented P2 format
used only by Eclipse.

So, switch the build to use Apache Felix's maven-bundle-plugin.

This is the same plugin Jetty uses to produce their OSGi bundle
manifests, and is the same plugin used by the Apache Felix project,
which is an open-source OSGi runtime.  It has a reasonable number
of folks using it for production builds, and is running on top of
the stable Maven 2.x code base.

With this switch we get automatically generated MANIFEST.MF files
based on reasonably sane default rules, which reduces the amount
of things we have to maintain by hand.  When necessary, we can add
a few lines of XML to our POMs to tweak the output.

Our build artifacts are still fully compatible with Maven 2.x, so
any downstream consumers are still able to use our build products,
without stepping up to Maven 3.x.  Our artifacts are also valid as
OSGi bundles, provided they are organized on disk into a repository
that the runtime can read.

With maven-bundle-plugin the build runs offline, as much as Maven
2.x is able to run offline anyway, so we're able to return to a
distributed development environment again.

By generating MANIFEST.MF at the top level of each project (and
therefore outside of the target directory), we're still compatible
with Eclipse's PDE tooling.  Our projects can be imported as standard
Maven projects using the m2eclipse plugin, but the PDE will think
they are vaild plugins and make them available for plugin builds,
or while debugging another workbench.

This change also completely removes Tycho from the build.

Unfortunately, Tycho 0.6.0's pom-first dependency resolver is broken
when resolving a pom-first plugin bundle through a manifest-first
feature package, so bundle org.eclipse.jgit can't be resolved,
even though it might actually exist in the local Maven repository.

Rather than fight with Tycho any further, I'm just declaring it
plugina-non-grata and ripping it out of the build.

Since there are very few tools to build a P2 format repository, and
no documentation on how to create one without running the Eclipse
UI manually by poking buttons, I'm declaring that we are not going
to produce a P2 update site from our automated builds.

Change-Id: If7938a86fb0cc8e25099028d832dbd38110b9124
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>

If we are on a Java 6 JVM we should have the Console class available,
unless the user has redirected /dev/null to stdin.  When there is a
console present we would prefer to use that for command line prompts
as that is what the user expects from a command line tool.

Change-Id: Ibaf87bb5540371d94d96d1b7e94ca002f752e5bd
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>

The LocalDiskRepositoryTestCase class is derived from the current
RepositoryTestCase code and is meant for application (or our own)
tests to subclass and access temporary repositories on the local
client disk.

Change-Id: Idff096cea40a7b2b56a90fb5de179ba61ea3a0eb
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>

Drop our simple and stupid jgit.sh and instead rely upon Maven
for the command line based build.  Maven is relatively simple to
download and install, and doesn't require the entire Eclipse IDE.

To avoid too much refactoring of the current code we reuse the
existing src/ directory within each plugin, and treat each of
the existing OSGI bundles as one Maven artifact.

The command line wrapper jgit.sh no longer works in the uncompiled
state, as we don't know where to obtain our JSch or args4j from.
Developers will now need to compile it with `mvn package`, or run
our Main class from within an IDE which has the proper classpath.

Bug: 291265
Change-Id: I355e95fa92fa7502651091d2b651be6917a26805
Signed-off-by: Shawn O. Pearce <spearce@spearce.org>

Per CQ 3448 this is the initial contribution of the JGit project
to eclipse.org.  It is derived from the historical JGit repository
at commit 3a2dd9921c.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>