Merge branch 'stable-3.7' into stable-3.8

* stable-3.7:
  Update git submodules
  Document missing options of ls-projects command
  Bazel: Add support for BuildBuddy RBE provider
  Specify GCP suffix explicitly in Bazel remote configuration
  Bazel: Optimize RBE execution
  Bazel: Clean up configuration options
  Bump SSHD version to 2.12.0

Change-Id: I38b3e832f2a42d89ab049052aaf3b80b6c1cdeff
Release-Notes: skip

6 files changed, 114 insertions, 43 deletions

diff --git a/.bazelrc b/.bazelrc
index cf5403d2b0..7c7d98bd73 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -3,29 +3,49 @@ build --repository_cache=~/.gerritcodereview/bazel-cache/repository
 build --action_env=PATH
 build --disk_cache=~/.gerritcodereview/bazel-cache/cas
 
+# Define configuration using remotejdk_11, executes using remotejdk_11 or local_jdk
+build:build_shared --java_language_version=11
+build:build_shared --java_runtime_version=remotejdk_11
+build:build_shared --tool_java_language_version=11
+build:build_shared --tool_java_runtime_version=remotejdk_11
+
 # Builds using remotejdk_11, executes using remotejdk_11 or local_jdk
+# Avoid warnings for non default configurations:
+# build --config=build_shared
 build --java_language_version=11
 build --java_runtime_version=remotejdk_11
 build --tool_java_language_version=11
 build --tool_java_runtime_version=remotejdk_11
 
-# Builds using remotejdk_17, executes using remotejdk_17 or local_jdk
-build:java17 --java_language_version=17
-build:java17 --java_runtime_version=remotejdk_17
-build:java17 --tool_java_language_version=17
-build:java17 --tool_java_runtime_version=remotejdk_17
-
-# Builds and executes on RBE using remotejdk_11
-build:remote --java_language_version=11
-build:remote --java_runtime_version=remotejdk_11
-build:remote --tool_java_language_version=11
-build:remote --tool_java_runtime_version=remotejdk_11
-
-# Builds and executes on RBE using remotejdk_17
-build:remote17 --java_language_version=17
-build:remote17 --java_runtime_version=remotejdk_17
-build:remote17 --tool_java_language_version=17
-build:remote17 --tool_java_runtime_version=remotejdk_17
+# Builds and executes on Google GCP RBE using remotejdk_11
+build:remote --config=config_gcp
+build:remote --config=build_shared
+
+# Define remote configuration alias
+build:remote_gcp --config=remote
+
+# Builds and executes on BuildBuddy RBE using remotejdk_11
+build:remote_bb --config=config_bb
+build:remote_bb --config=build_shared
+
+# Define configuration using remotejdk_17, executes using remotejdk_17 or local_jdk
+build:build_java17_shared --java_language_version=17
+build:build_java17_shared --java_runtime_version=remotejdk_17
+build:build_java17_shared --tool_java_language_version=17
+build:build_java17_shared --tool_java_runtime_version=remotejdk_17
+
+build:java17 --config=build_java17_shared
+
+# Builds and executes on Google GCP RBE using remotejdk_17
+build:remote17 --config=config_gcp
+build:remote17 --config=build_java17_shared
+
+# Define remote17 configuration alias
+build:remote17_gcp --config=remote17
+
+# Builds and executes on BuildBuddy RBE using remotejdk_17
+build:remote17_bb --config=config_bb
+build:remote17_bb --config=build_java17_shared
 
 # Enable strict_action_env flag to. For more information on this feature see
 # https://groups.google.com/forum/#!topic/bazel-discuss/_VmRfMyyHBk.
diff --git a/Documentation/cmd-ls-projects.txt b/Documentation/cmd-ls-projects.txt
index ebd365af7f..72e7630a7b 100644
--- a/Documentation/cmd-ls-projects.txt
+++ b/Documentation/cmd-ls-projects.txt
@@ -16,6 +16,10 @@ _ssh_ -p <port> <host> _gerrit ls-projects_
   [--limit <N>]
   [--prefix | -p <prefix>]
   [--has-acl-for GROUP]
+  [--match | -m]
+  [-r REGEX]
+  [--start | -S]
+  [--state | -s ]
 --
 
 == DESCRIPTION
@@ -58,6 +62,22 @@ used to unescape the output.
 	Displays project inheritance in a tree-like format.
 	This option does not work together with the show-branch option.
 
+--match::
+-m
+  Match project substring
+
+-r::
+  Match project regex
+
+--start::
+-S::
+  Number of projects to skip
+
+--state::
+-s::
+  Filter by project state. [ACTIVE | READON_ONLY | HIDDEN]
+
+
 [NOTE]
 If the calling user does not meet any of the following criteria:
 
diff --git a/Documentation/dev-bazel.txt b/Documentation/dev-bazel.txt
index 1c3fd78808..a70066990c 100644
--- a/Documentation/dev-bazel.txt
+++ b/Documentation/dev-bazel.txt
@@ -663,6 +663,21 @@ bazel test --config=remote \
 ```
 
 
+== BuildBuddy Remote Build Support
+
+To utilize the BuildBuddy Remote Build Execution service, please consult the
+documentation available at the following link: https://www.buildbuddy.io[BuildBuddy].
+
+To use RBE, execute
+
+```
+bazelisk test --config=remote_bb \
+    --remote_instance_name=projects/${PROJECT}/instances/default_instance \
+    --remote_header=x-buildbuddy-api-key=YOUR_API_KEY \
+    javatests/...
+```
+
+
 GERRIT
 ------
 Part of link:index.html[Gerrit Code Review]
diff --git a/java/com/google/gerrit/sshd/SshDaemon.java b/java/com/google/gerrit/sshd/SshDaemon.java
index cc35a32beb..af7d22bee0 100644
--- a/java/com/google/gerrit/sshd/SshDaemon.java
+++ b/java/com/google/gerrit/sshd/SshDaemon.java
@@ -77,6 +77,7 @@ import org.apache.sshd.common.file.nonefs.NoneFileSystemFactory;
 import org.apache.sshd.common.forward.DefaultForwarderFactory;
 import org.apache.sshd.common.future.CloseFuture;
 import org.apache.sshd.common.future.SshFutureListener;
+import org.apache.sshd.common.global.KeepAliveHandler;
 import org.apache.sshd.common.io.AbstractIoServiceFactory;
 import org.apache.sshd.common.io.IoAcceptor;
 import org.apache.sshd.common.io.IoServiceFactory;
@@ -109,7 +110,6 @@ import org.apache.sshd.server.auth.pubkey.UserAuthPublicKeyFactory;
 import org.apache.sshd.server.command.CommandFactory;
 import org.apache.sshd.server.forward.ForwardingFilter;
 import org.apache.sshd.server.global.CancelTcpipForwardHandler;
-import org.apache.sshd.server.global.KeepAliveHandler;
 import org.apache.sshd.server.global.NoMoreSessionsHandler;
 import org.apache.sshd.server.global.TcpipForwardHandler;
 import org.apache.sshd.server.session.ServerSessionImpl;
diff --git a/tools/nongoogle.bzl b/tools/nongoogle.bzl
index 7f26ef3493..dc6e6e0403 100644
--- a/tools/nongoogle.bzl
+++ b/tools/nongoogle.bzl
@@ -67,18 +67,18 @@ def declare_nongoogle_deps():
         sha1 = "cb2f351bf4463751201f43bb99865235d5ba07ca",
     )
 
-    SSHD_VERS = "2.9.2"
+    SSHD_VERS = "2.12.0"
 
     maven_jar(
         name = "sshd-osgi",
         artifact = "org.apache.sshd:sshd-osgi:" + SSHD_VERS,
-        sha1 = "bac0415734519b2fe433fea196017acf7ed32660",
+        sha1 = "32b8de1cbb722ba75bdf9898e0c41d42af00ce57",
     )
 
     maven_jar(
         name = "sshd-sftp",
         artifact = "org.apache.sshd:sshd-sftp:" + SSHD_VERS,
-        sha1 = "7f9089c87b3b44f19998252fd3b68637e3322920",
+        sha1 = "0f96f00a07b186ea62838a6a4122e8f4cad44df6",
     )
 
     maven_jar(
@@ -96,7 +96,7 @@ def declare_nongoogle_deps():
     maven_jar(
         name = "sshd-mina",
         artifact = "org.apache.sshd:sshd-mina:" + SSHD_VERS,
-        sha1 = "765dced3a2b4069bb0c550e18bda057bad8de26f",
+        sha1 = "8b202f7d4c0d7b714fd0c93a1352af52aa031149",
     )
 
     maven_jar(
diff --git a/tools/remote-bazelrc b/tools/remote-bazelrc
index c9a83e47c2..d8da574151 100644
--- a/tools/remote-bazelrc
+++ b/tools/remote-bazelrc
@@ -25,41 +25,57 @@
 # this higher can make builds faster by allowing more jobs to run in parallel.
 # Setting it too high can result in jobs that timeout, however, while waiting
 # for a remote machine to execute them.
-build:remote --jobs=200
-build:remote --disk_cache=
+build:remote_shared --jobs=200
+build:remote_shared --disk_cache=
+build:remote_shared --remote_download_minimal
 
 # Set several flags related to specifying the platform, toolchain and java
 # properties.
-build:remote --crosstool_top=@rbe_jdk11//cc:toolchain
-build:remote --extra_toolchains=@rbe_jdk11//config:cc-toolchain
-build:remote --extra_execution_platforms=@rbe_jdk11//config:platform
-build:remote --host_platform=@rbe_jdk11//config:platform
-build:remote --platforms=@rbe_jdk11//config:platform
-build:remote --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+build:remote_shared --crosstool_top=@rbe_jdk11//cc:toolchain
+build:remote_shared --extra_toolchains=@rbe_jdk11//config:cc-toolchain
+build:remote_shared --extra_execution_platforms=@rbe_jdk11//config:platform
+build:remote_shared --host_platform=@rbe_jdk11//config:platform
+build:remote_shared --platforms=@rbe_jdk11//config:platform
+build:remote_shared --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 # Set various strategies so that all actions execute remotely. Mixing remote
 # and local execution will lead to errors unless the toolchain and remote
 # machine exactly match the host machine.
-build:remote --define=EXECUTOR=remote
+build:remote_shared --define=EXECUTOR=remote
 
+# Set a higher timeout value, just in case.
+build:remote_shared --remote_timeout=3600
+
+# Configuration flags for remote settings in Google GCP RBE
 # Enable the remote cache so action results can be shared across machines,
 # developers, and workspaces.
-build:remote --remote_cache=remotebuildexecution.googleapis.com
+build:config_gcp --remote_cache=remotebuildexecution.googleapis.com
 
 # Enable remote execution so actions are performed on the remote systems.
-build:remote --remote_executor=remotebuildexecution.googleapis.com
-
-# Set a higher timeout value, just in case.
-build:remote --remote_timeout=3600
+build:config_gcp --remote_executor=remotebuildexecution.googleapis.com
 
 # Enable authentication. This will pick up application default credentials by
 # default. You can use --auth_credentials=some_file.json to use a service
 # account credential instead.
-build:remote --google_default_credentials
+build:config_gcp --google_default_credentials
+build:config_gcp --config=remote_shared
+
+# Configuration flags for remote settings in BuildBuddy RBE
+# Enable the remote cache so action results can be shared across machines,
+# developers, and workspaces.
+build:config_bb --remote_cache=grpcs://remote.buildbuddy.io
+
+# Enable remote execution so actions are performed on the remote systems.
+build:config_bb --remote_executor=grpcs://remote.buildbuddy.io
+
+# The results from each Bazel command are viewable with BuildBuddy
+build:config_bb --bes_results_url=https://app.buildbuddy.io/invocation/
+
+# The results of a local build will be uploaded to the BuildBuddy server,
+# providing visibility and collaboration features for the build.
+build:config_bb --remote_upload_local_results
 
-# The following flags enable the remote cache so action results can be shared
-# across machines, developers, and workspaces.
-build:remote-cache --remote_cache=remotebuildexecution.googleapis.com
-build:remote-cache --tls_enabled=true
-build:remote-cache --remote_timeout=3600
-build:remote-cache --auth_enabled=true
+# Define the Build Event Service (BES) backend to use for remote caching and
+# build event storage.
+build:config_bb --bes_backend=grpcs://remote.buildbuddy.io
+build:config_bb --config=remote_shared