Don't ship bouncycastle libraries in plugin API

We cannot shade bouncycastle in the plugin API. Still we need it to be
included in the gerrit.war, licenses file and Eclipse classpath.

Expose bouncycastle libraries in PLUGIN_TEST_DEPS constant, so that
the plugins don't need to change anything in tree build mode.

gerrit_api() bazlet in bazlets repository is extended too, so that the
plugins don't need to change anything in standalone build mode.

One side effect of this change, is that bouncycastle libraries are
now listed with neverlink suffix, e.g.:

* bouncycastle:bcprov-neverlink

Bug: Issue 5826
Change-Id: Idb8051e16b14e20c8dd528783ab297ee25707bb3

7 files changed, 41 insertions, 10 deletions

diff --git a/gerrit-acceptance-tests/tests.bzl b/gerrit-acceptance-tests/tests.bzl
index 3b1a4f4be6..594e58394d 100644
--- a/gerrit-acceptance-tests/tests.bzl
+++ b/gerrit-acceptance-tests/tests.bzl
@@ -10,8 +10,6 @@ def acceptance_tests(
     name = group,
     deps = deps + [
       '//gerrit-acceptance-tests:lib',
-      "//lib/bouncycastle:bcpkix",
-      "//lib/bouncycastle:bcpg",
     ],
     tags = labels + [
       'acceptance',
diff --git a/gerrit-gpg/BUILD b/gerrit-gpg/BUILD
index 1d949d15d8..680071f3da 100644
--- a/gerrit-gpg/BUILD
+++ b/gerrit-gpg/BUILD
@@ -19,8 +19,8 @@ java_library(
     srcs = glob(["src/main/java/**/*.java"]),
     visibility = ["//visibility:public"],
     deps = DEPS + [
-        "//lib/bouncycastle:bcpg",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpg-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
     ],
 )
 
@@ -32,9 +32,9 @@ java_library(
     srcs = TESTUTIL_SRCS,
     visibility = ["//visibility:public"],
     deps = DEPS + [
+        "//lib/bouncycastle:bcpg-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
         ":gpg",
-        "//lib/bouncycastle:bcpg",
-        "//lib/bouncycastle:bcprov",
     ],
 )
 
diff --git a/gerrit-server/BUILD b/gerrit-server/BUILD
index a8ac50d759..adfe7a46b1 100644
--- a/gerrit-server/BUILD
+++ b/gerrit-server/BUILD
@@ -55,8 +55,8 @@ java_library(
         "//lib:velocity",
         "//lib/antlr:java_runtime",
         "//lib/auto:auto-value",
-        "//lib/bouncycastle:bcpkix",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpkix-neverlink",
+        "//lib/bouncycastle:bcprov-neverlink",
         "//lib/commons:codec",
         "//lib/commons:compress",
         "//lib/commons:dbcp",
@@ -230,6 +230,7 @@ junit_tests(
         "//lib:guava-retrying",
         "//lib:protobuf",
         "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcpkix",
         "//lib/dropwizard:dropwizard-core",
         "//lib/guice:guice-assistedinject",
         "//lib/prolog:runtime",
diff --git a/gerrit-sshd/BUILD b/gerrit-sshd/BUILD
index 2288e5d3bf..db27f02597 100644
--- a/gerrit-sshd/BUILD
+++ b/gerrit-sshd/BUILD
@@ -23,7 +23,7 @@ java_library(
         "//lib:jsch",
         "//lib:servlet-api-3_1",
         "//lib/auto:auto-value",
-        "//lib/bouncycastle:bcprov",
+        "//lib/bouncycastle:bcprov-neverlink",
         "//lib/commons:codec",
         "//lib/dropwizard:dropwizard-core",
         "//lib/guice",
diff --git a/lib/bouncycastle/BUILD b/lib/bouncycastle/BUILD
index 746a982cff..cf3e996263 100644
--- a/lib/bouncycastle/BUILD
+++ b/lib/bouncycastle/BUILD
@@ -18,3 +18,27 @@ java_library(
     visibility = ["//visibility:public"],
     exports = ["@bcpkix//jar"],
 )
+
+java_library(
+    name = "bcprov-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcprov//jar"],
+)
+
+java_library(
+    name = "bcpg-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcpg//jar"],
+)
+
+java_library(
+    name = "bcpkix-neverlink",
+    data = ["//lib:LICENSE-bouncycastle"],
+    neverlink = 1,
+    visibility = ["//visibility:public"],
+    exports = ["@bcpkix//jar"],
+)
diff --git a/tools/bzl/pkg_war.bzl b/tools/bzl/pkg_war.bzl
index 7eebcd3d82..edaaab044a 100644
--- a/tools/bzl/pkg_war.bzl
+++ b/tools/bzl/pkg_war.bzl
@@ -21,6 +21,9 @@ LIBS = [
     "//gerrit-war:log4j-config",
     "//gerrit-war:version",
     "//lib:postgresql",
+    "//lib/bouncycastle:bcpkix",
+    "//lib/bouncycastle:bcprov",
+    "//lib/bouncycastle:bcpg",
     "//lib/log:impl_log4j",
 ]
 
diff --git a/tools/bzl/plugin.bzl b/tools/bzl/plugin.bzl
index de82af804d..59e7335e59 100644
--- a/tools/bzl/plugin.bzl
+++ b/tools/bzl/plugin.bzl
@@ -12,7 +12,12 @@ load(
 
 PLUGIN_DEPS = ["//gerrit-plugin-api:lib"]
 
-PLUGIN_TEST_DEPS = ["//gerrit-acceptance-framework:lib"]
+PLUGIN_TEST_DEPS = [
+    "//gerrit-acceptance-framework:lib",
+    "//lib/bouncycastle:bcpg",
+    "//lib/bouncycastle:bcpkix",
+    "//lib/bouncycastle:bcprov",
+]
 
 def gerrit_plugin(
     name,