dev-java/protobuf-java: add 3.19.6, 3.20.3, 3.21.8 (bug #876903)

* Adding Java team to maintainers since the only known consumer of this package
is dev-java/jdbc-mysql which is maintained by Java team. (cherry-picked
from PR 26066)

* Also respond to CVE-2022-3171 (bug 876903).

Bug: https://bugs.gentoo.org/876903
Signed-off-by: Thibaud CANALE <thican@thican.net>
Signed-off-by: Volkmar W. Pogatzki <gentoo@pogatzki.net>
Closes: https://github.com/gentoo/gentoo/pull/26066
Closes: https://github.com/gentoo/gentoo/pull/26888
(cherry picked from commit a119081e17f64f19094278220680e449e01da386)
Signed-off-by: Sam James <sam@gentoo.org>

6 files changed, 389 insertions, 26 deletions

diff --git a/dev-java/protobuf-java/Manifest b/dev-java/protobuf-java/Manifest
index dfb0564c5120..74313749d43f 100644
--- a/dev-java/protobuf-java/Manifest
+++ b/dev-java/protobuf-java/Manifest
@@ -1,2 +1,5 @@
+DIST protobuf-21.8.tar.gz 5110670 BLAKE2B 3c1b0c857a86e9586481d63896341d0cb11290dbd710d87a6f7889d34f5f262abe2986a29ed19a730f8fa5df0b5c62d77a4db6aa415a72b239f7483ae8d6380c SHA512 cb17be759311e91172801add1f88fe7a0291b547170c40d2e3303f5c248570dddeade96bd48740edd628215f55269c97475e2f4c4a41c50f1018d525f52036cb
 DIST protobuf-3.19.3.tar.gz 5293258 BLAKE2B c05b70ffca97f7166ea6a511a36907eed125edf1ebf17f908718221d9b851be84dfb2b1b39973f2faf35f6ade630e6ba4f9e8b91b8fbc922c5db97079323ee6e SHA512 1c003e7cbc8eae6a038f46e688b401ee202ba47f502561e909df79770f6e8b7daf3dc1ccc727e31bfb5b52cd04cb4fef7d2d2a28d650c13f396872ad4aa076c6
+DIST protobuf-3.19.6.tar.gz 5299501 BLAKE2B 3121f76b95f83c5309ce49ce296b738eff7be9d3a5093c564fbe2339fb5f3729e406f1b44bfcc05feb0d31ab63838bb4f54685017977c73a33b91215a6776072 SHA512 8f92242f2be8e1bbfba41341c87709ad91ad83b8b3e3df88bb430411541d3399295f49291fd52b50e3487b0fce33181cb4d175685fd25aac72adfaee26a612d4
 DIST protobuf-3.20.1.tar.gz 5368262 BLAKE2B 1ce1aef2e4c4f3ea4863629cc75d89fe17d0c7ac0c342ac641c787456fd4a12756c2892a27ddadedc94a7201494ec84566638ce33a03cb0c867b04e9eee0edb3 SHA512 fde3eb9f13946887ddfd87df428c5615ad09aaf191e4478b24e98e5e13231feeff4e70b4ca6a2ff7d9b9b2e2c60bc1d5479526edeafa78f9a8ed3bef2e0bacb0
+DIST protobuf-3.20.3.tar.gz 5374320 BLAKE2B fb51f2a0ecf5b83235f5252051f8192ae377bb7a5e030c3f3e9435ccde25919c059830cf476e840fa6c970928a32c0075e213c9d5d4d9e3d3b24732c39a9fbfa SHA512 01d6703bdbe769a1200ee6e4ebcdcb99688ec21f576988c60d82ec36e0822820fb245fcb4ca53293143d53e666d748b5a0c6937bc659fb3cdc4cd9b05ed12a1c
diff --git a/dev-java/protobuf-java/metadata.xml b/dev-java/protobuf-java/metadata.xml
index 7fc9e27ef82d..5fdb33c1c7c3 100644
--- a/dev-java/protobuf-java/metadata.xml
+++ b/dev-java/protobuf-java/metadata.xml
@@ -9,6 +9,9 @@
 		<email>cjk@gentoo.org</email>
 		<name>Cjk</name>
 	</maintainer>
+	<maintainer type="project">
+		<email>java@gentoo.org</email>
+	</maintainer>
 	<slots>
 		<subslots>Soname version number of Protobuf</subslots>
 	</slots>
diff --git a/dev-java/protobuf-java/protobuf-java-3.19.6.ebuild b/dev-java/protobuf-java/protobuf-java-3.19.6.ebuild
new file mode 100644
index 000000000000..6adff3a717e4
--- /dev/null
+++ b/dev-java/protobuf-java/protobuf-java-3.19.6.ebuild
@@ -0,0 +1,102 @@
+# Copyright 2008-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+MAVEN_ID="com.google.protobuf:${PN}:${PV}"
+# Tests not enabled, depend on com.google.truth which is not packaged
+# https://github.com/protocolbuffers/protobuf/blob/v3.19.6/java/core/pom.xml#L35-L40
+# JAVA_TESTING_FRAMEWORKS="junit-4"
+
+inherit java-pkg-2 java-pkg-simple
+
+PARENT_PN="${PN/-java/}"
+PARENT_PV="${PV}"
+PARENT_P="${PARENT_PN}-${PARENT_PV}"
+
+if [[ "${PV}" == *9999 ]]; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
+	EGIT_SUBMODULES=()
+	EGIT_CHECKOUT_DIR="${WORKDIR}/${PARENT_P}"
+else
+	SRC_URI="
+		https://github.com/protocolbuffers/protobuf/archive/v${PARENT_PV}.tar.gz
+			-> ${PARENT_P}.tar.gz
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+fi
+
+DESCRIPTION="Google's Protocol Buffers - Java bindings"
+HOMEPAGE="
+	https://developers.google.com/protocol-buffers/
+"
+
+LICENSE="BSD"
+SLOT="0/30"
+
+S="${WORKDIR}/${PARENT_P}/java"
+
+BDEPEND="
+	dev-libs/protobuf:${SLOT}
+"
+DEPEND="
+	>=virtual/jdk-1.8:*
+	test? (
+		dev-java/guava:0
+		dev-java/mockito:4
+	)
+"
+RDEPEND="
+	>=virtual/jre-1.8:*
+"
+
+JAVA_AUTOMATIC_MODULE_NAME="com.google.protobuf"
+JAVA_JAR_FILENAME="protobuf.jar"
+JAVA_RESOURCE_DIRS="core/src/main/resources"
+JAVA_SRC_DIR="core/src/main/java"
+
+JAVA_TEST_GENTOO_CLASSPATH="guava,junit-4,mockito-4"
+JAVA_TEST_RESOURCE_DIRS="../src"
+JAVA_TEST_SRC_DIR="core/src/test/java"
+
+# Same than PATCHES but from repository's root directory,
+# please see function `src_prepare` below.
+# Simplier for users IMHO.
+PARENT_PATCHES=(
+)
+
+# Here for patches within "java/" subdirectory.
+PATCHES=(
+)
+
+src_prepare() {
+	pushd "${WORKDIR}/${PARENT_P}" > /dev/null || die
+	[[ -n "${PARENT_PATCHES[@]}" ]] && eapply "${PARENT_PATCHES[@]}"
+	eapply_user
+	popd > /dev/null || die
+
+	# Remove bundled jars
+	java-pkg_clean
+
+	java-pkg-2_src_prepare
+
+	# There is also compiler/plugin, but not in this list because in a subdirectory
+	core_protos=( any api descriptor duration empty field_mask source_context struct timestamp type wrappers )
+
+	# Copy resources from ../src/google/protobuf according to
+	# https://github.com/protocolbuffers/protobuf/blob/v3.19.6/java/core/pom.xml#L45-L61
+	mkdir -p "${JAVA_RESOURCE_DIRS}/google/protobuf/compiler" || die
+	cp "../src/google/protobuf/${core_protos[@]}.proto" \
+		"${JAVA_RESOURCE_DIRS}/google/protobuf" || die
+	cp {../src,"${JAVA_RESOURCE_DIRS}"}/google/protobuf/compiler/plugin.proto || die
+
+	# Generate 146 .java files according to
+	# https://github.com/protocolbuffers/protobuf/blob/v3.19.6/java/core/generate-sources-build.xml
+	for proto in "${core_protos[@]}" compiler/plugin; do
+		"${BROOT}/usr/bin/protoc" \
+			--java_out="${JAVA_SRC_DIR}" -I../src ../src/google/protobuf/"${proto}".proto || die
+	done
+}
diff --git a/dev-java/protobuf-java/protobuf-java-3.20.3.ebuild b/dev-java/protobuf-java/protobuf-java-3.20.3.ebuild
new file mode 100644
index 000000000000..2e58b824d118
--- /dev/null
+++ b/dev-java/protobuf-java/protobuf-java-3.20.3.ebuild
@@ -0,0 +1,102 @@
+# Copyright 2008-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+MAVEN_ID="com.google.protobuf:${PN}:${PV}"
+# Tests not enabled, depend on com.google.truth which is not packaged
+# https://github.com/protocolbuffers/protobuf/blob/v3.20.3/java/core/pom.xml#L35-L40
+# JAVA_TESTING_FRAMEWORKS="junit-4"
+
+inherit java-pkg-2 java-pkg-simple
+
+PARENT_PN="${PN/-java/}"
+PARENT_PV="${PV}"
+PARENT_P="${PARENT_PN}-${PARENT_PV}"
+
+if [[ "${PV}" == *9999 ]]; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
+	EGIT_SUBMODULES=()
+	EGIT_CHECKOUT_DIR="${WORKDIR}/${PARENT_P}"
+else
+	SRC_URI="
+		https://github.com/protocolbuffers/protobuf/archive/v${PARENT_PV}.tar.gz
+			-> ${PARENT_P}.tar.gz
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+fi
+
+DESCRIPTION="Google's Protocol Buffers - Java bindings"
+HOMEPAGE="
+	https://developers.google.com/protocol-buffers/
+"
+
+LICENSE="BSD"
+SLOT="0/31"
+
+S="${WORKDIR}/${PARENT_P}/java"
+
+BDEPEND="
+	dev-libs/protobuf:${SLOT}
+"
+DEPEND="
+	>=virtual/jdk-1.8:*
+	test? (
+		dev-java/guava:0
+		dev-java/mockito:4
+	)
+"
+RDEPEND="
+	>=virtual/jre-1.8:*
+"
+
+JAVA_AUTOMATIC_MODULE_NAME="com.google.protobuf"
+JAVA_JAR_FILENAME="protobuf.jar"
+JAVA_RESOURCE_DIRS="core/src/main/resources"
+JAVA_SRC_DIR="core/src/main/java"
+
+JAVA_TEST_GENTOO_CLASSPATH="guava,junit-4,mockito-4"
+JAVA_TEST_RESOURCE_DIRS="../src"
+JAVA_TEST_SRC_DIR="core/src/test/java"
+
+# Same than PATCHES but from repository's root directory,
+# please see function `src_prepare` below.
+# Simplier for users IMHO.
+PARENT_PATCHES=(
+)
+
+# Here for patches within "java/" subdirectory.
+PATCHES=(
+)
+
+src_prepare() {
+	pushd "${WORKDIR}/${PARENT_P}" > /dev/null || die
+	[[ -n "${PARENT_PATCHES[@]}" ]] && eapply "${PARENT_PATCHES[@]}"
+	eapply_user
+	popd > /dev/null || die
+
+	# Remove bundled jars
+	java-pkg_clean
+
+	java-pkg-2_src_prepare
+
+	# There is also compiler/plugin, but not in this list because in a subdirectory
+	core_protos=( any api descriptor duration empty field_mask source_context struct timestamp type wrappers )
+
+	# Copy resources from ../src/google/protobuf according to
+	# https://github.com/protocolbuffers/protobuf/blob/v3.20.2/java/core/pom.xml#L45-L61
+	mkdir -p "${JAVA_RESOURCE_DIRS}/google/protobuf/compiler" || die
+	cp "../src/google/protobuf/${core_protos[@]}.proto" \
+		"${JAVA_RESOURCE_DIRS}/google/protobuf" || die
+	cp {../src,"${JAVA_RESOURCE_DIRS}"}/google/protobuf/compiler/plugin.proto || die
+
+	# Generate 146 .java files according to
+	# https://github.com/protocolbuffers/protobuf/blob/v3.20.3/java/core/generate-sources-build.xml
+	for proto in "${core_protos[@]}" compiler/plugin; do
+		"${BROOT}/usr/bin/protoc" \
+			--java_out="${JAVA_SRC_DIR}" -I../src ../src/google/protobuf/"${proto}".proto || die
+	done
+}
diff --git a/dev-java/protobuf-java/protobuf-java-3.21.8.ebuild b/dev-java/protobuf-java/protobuf-java-3.21.8.ebuild
new file mode 100644
index 000000000000..abe81a5bcd1d
--- /dev/null
+++ b/dev-java/protobuf-java/protobuf-java-3.21.8.ebuild
@@ -0,0 +1,102 @@
+# Copyright 2008-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+JAVA_PKG_IUSE="doc source test"
+MAVEN_ID="com.google.protobuf:${PN}:${PV}"
+# Tests not enabled, depend on com.google.truth which is not packaged
+# https://github.com/protocolbuffers/protobuf/blob/v21.7/java/core/pom.xml#L35-L40
+# JAVA_TESTING_FRAMEWORKS="junit-4"
+
+inherit java-pkg-2 java-pkg-simple
+
+PARENT_PN="${PN/-java/}"
+PARENT_PV="$(ver_cut 2-)"
+PARENT_P="${PARENT_PN}-${PARENT_PV}"
+
+if [[ "${PV}" == *9999 ]]; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
+	EGIT_SUBMODULES=()
+	EGIT_CHECKOUT_DIR="${WORKDIR}/${PARENT_P}"
+else
+	SRC_URI="
+		https://github.com/protocolbuffers/protobuf/archive/v${PARENT_PV}.tar.gz
+			-> ${PARENT_P}.tar.gz
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+fi
+
+DESCRIPTION="Google's Protocol Buffers - Java bindings"
+HOMEPAGE="
+	https://developers.google.com/protocol-buffers/
+"
+
+LICENSE="BSD"
+SLOT="0/32"
+
+S="${WORKDIR}/${PARENT_P}/java"
+
+BDEPEND="
+	dev-libs/protobuf:${SLOT}
+"
+DEPEND="
+	>=virtual/jdk-1.8:*
+	test? (
+		dev-java/guava:0
+		dev-java/mockito:4
+	)
+"
+RDEPEND="
+	>=virtual/jre-1.8:*
+"
+
+JAVA_AUTOMATIC_MODULE_NAME="com.google.protobuf"
+JAVA_JAR_FILENAME="protobuf.jar"
+JAVA_RESOURCE_DIRS="core/src/main/resources"
+JAVA_SRC_DIR="core/src/main/java"
+
+JAVA_TEST_GENTOO_CLASSPATH="guava,junit-4,mockito-4"
+JAVA_TEST_RESOURCE_DIRS="../src"
+JAVA_TEST_SRC_DIR="core/src/test/java"
+
+# Same than PATCHES but from repository's root directory,
+# please see function `src_prepare` below.
+# Simplier for users IMHO.
+PARENT_PATCHES=(
+)
+
+# Here for patches within "java/" subdirectory.
+PATCHES=(
+)
+
+src_prepare() {
+	pushd "${WORKDIR}/${PARENT_P}" > /dev/null || die
+	[[ -n "${PARENT_PATCHES[@]}" ]] && eapply "${PARENT_PATCHES[@]}"
+	eapply_user
+	popd > /dev/null || die
+
+	# Remove bundled jars
+	java-pkg_clean
+
+	java-pkg-2_src_prepare
+
+	# There is also compiler/plugin, but not in this list because in a subdirectory
+	core_protos=( any api descriptor duration empty field_mask source_context struct timestamp type wrappers )
+
+	# Copy resources from ../src/google/protobuf according to
+	# https://github.com/protocolbuffers/protobuf/blob/v21.7/java/core/pom.xml#L45-L61
+	mkdir -p "${JAVA_RESOURCE_DIRS}/google/protobuf/compiler" || die
+	cp "../src/google/protobuf/${core_protos[@]}.proto" \
+		"${JAVA_RESOURCE_DIRS}/google/protobuf" || die
+	cp {../src,"${JAVA_RESOURCE_DIRS}"}/google/protobuf/compiler/plugin.proto || die
+
+	# Generate 146 .java files according to
+	# https://github.com/protocolbuffers/protobuf/blob/v21.7/java/core/generate-sources-build.xml
+	for proto in "${core_protos[@]}" compiler/plugin; do
+		"${BROOT}/usr/bin/protoc" \
+			--java_out="${JAVA_SRC_DIR}" -I../src ../src/google/protobuf/"${proto}".proto || die
+	done
+}
diff --git a/dev-java/protobuf-java/protobuf-java-9999.ebuild b/dev-java/protobuf-java/protobuf-java-9999.ebuild
index 43fa605b496c..ab4856250e05 100644
--- a/dev-java/protobuf-java/protobuf-java-9999.ebuild
+++ b/dev-java/protobuf-java/protobuf-java-9999.ebuild
@@ -3,52 +3,103 @@
 
 EAPI=8
 
-JAVA_PKG_IUSE="doc source"
+JAVA_PKG_IUSE="doc source test"
+# Version based on value in (java/)core/pom.xml from main branch
+# Please update me when new release
+# Maybe find a way to automatically change it?
+MAVEN_ID="com.google.protobuf:${PN}:3.21.7"
+# Tests not enabled, depend on com.google.truth which is not packaged
+# https://github.com/protocolbuffers/protobuf/blob/v21.7/java/core/pom.xml#L35-L40
+# JAVA_TESTING_FRAMEWORKS="junit-4"
 
 inherit java-pkg-2 java-pkg-simple
 
-if [[ "${PV}" == "9999" ]]; then
+PARENT_PN="${PN/-java/}"
+PARENT_PV="${PV}"
+PARENT_P="${PARENT_PN}-${PARENT_PV}"
+
+if [[ "${PV}" == *9999 ]]; then
 	inherit git-r3
 
-	EGIT_CHECKOUT_DIR="${WORKDIR}/protobuf-${PV}"
-	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf"
+	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
 	EGIT_SUBMODULES=()
+	EGIT_CHECKOUT_DIR="${WORKDIR}/${PARENT_P}"
+else
+	SRC_URI="
+		https://github.com/protocolbuffers/protobuf/archive/v${PARENT_PV}.tar.gz
+			-> ${PARENT_P}.tar.gz
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~x86 ~amd64-linux ~x86-linux ~x64-macos"
 fi
 
 DESCRIPTION="Google's Protocol Buffers - Java bindings"
-HOMEPAGE="https://developers.google.com/protocol-buffers/ https://github.com/protocolbuffers/protobuf"
-if [[ "${PV}" == "9999" ]]; then
-	SRC_URI=""
-else
-	SRC_URI="https://github.com/protocolbuffers/protobuf/archive/v${PV}.tar.gz -> protobuf-${PV}.tar.gz"
-fi
-S="${WORKDIR}/protobuf-${PV}/java"
+HOMEPAGE="
+	https://developers.google.com/protocol-buffers/
+"
 
 LICENSE="BSD"
-SLOT="0/31"
-KEYWORDS=""
+SLOT="0/32"
+
+S="${WORKDIR}/${PARENT_P}/java"
 
-COMMON_DEPEND=">=virtual/jdk-1.8:*"
 BDEPEND="
-	~dev-libs/protobuf-${PV}
-	${COMMON_DEPEND}
+	dev-libs/protobuf:${SLOT}
+"
+DEPEND="
+	>=virtual/jdk-1.8:*
+	test? (
+		dev-java/guava:0
+		dev-java/mockito:4
+	)
+"
+RDEPEND="
+	>=virtual/jre-1.8:*
 "
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${DEPEND}"
+
+JAVA_AUTOMATIC_MODULE_NAME="com.google.protobuf"
+JAVA_JAR_FILENAME="protobuf.jar"
+JAVA_RESOURCE_DIRS="core/src/main/resources"
+JAVA_SRC_DIR="core/src/main/java"
+
+JAVA_TEST_GENTOO_CLASSPATH="guava,junit-4,mockito-4"
+JAVA_TEST_RESOURCE_DIRS="../src"
+JAVA_TEST_SRC_DIR="core/src/test/java"
+
+# Same than PATCHES but from repository's root directory,
+# please see function `src_prepare` below.
+# Simplier for users IMHO.
+PARENT_PATCHES=(
+)
+
+# Here for patches within "java/" subdirectory.
+PATCHES=(
+)
 
 src_prepare() {
-	pushd "${WORKDIR}/protobuf-${PV}" > /dev/null || die
+	pushd "${WORKDIR}/${PARENT_P}" > /dev/null || die
+	[[ -n "${PARENT_PATCHES[@]}" ]] && eapply "${PARENT_PATCHES[@]}"
 	eapply_user
 	popd > /dev/null || die
 
+	# Remove bundled jars
+	java-pkg_clean
+
 	java-pkg-2_src_prepare
-}
 
-src_compile() {
-	"${BROOT}/usr/bin/protoc" --java_out=core/src/main/java -I../src ../src/google/protobuf/descriptor.proto || die
-	JAVA_SRC_DIR="core/src/main/java" JAVA_JAR_FILENAME="protobuf.jar" java-pkg-simple_src_compile
-}
+	# There is also compiler/plugin, but not in this list because in a subdirectory
+	core_protos=( any api descriptor duration empty field_mask source_context struct timestamp type wrappers )
+
+	# Copy resources from ../src/google/protobuf according to
+	# https://github.com/protocolbuffers/protobuf/blob/v21.7/java/core/pom.xml#L45-L61
+	mkdir -p "${JAVA_RESOURCE_DIRS}/google/protobuf/compiler" || die
+	cp "../src/google/protobuf/${core_protos[@]}.proto" \
+		"${JAVA_RESOURCE_DIRS}/google/protobuf" || die
+	cp {../src,"${JAVA_RESOURCE_DIRS}"}/google/protobuf/compiler/plugin.proto || die
 
-src_install() {
-	JAVA_SRC_DIR="core/src/main/java" JAVA_JAR_FILENAME="protobuf.jar" java-pkg-simple_src_install
+	# Generate 146 .java files according to
+	# https://github.com/protocolbuffers/protobuf/blob/v21.7/java/core/generate-sources-build.xml
+	for proto in "${core_protos[@]}" compiler/plugin; do
+		"${BROOT}/usr/bin/protoc" \
+			--java_out="${JAVA_SRC_DIR}" -I../src ../src/google/protobuf/"${proto}".proto || die
+	done
 }