gson: initial integration

[DavidKorczynski]

Integrates https://github.com/google/gson
Gson is a Google library for json serialization and is the second most used json library on mvnrepository: https://mvnrepository.com/open-source/json-libraries

[DavidKorczynski]

@inferno-chromium @jonathanmetzman @oliverchang calling on the current sheriff this one is good to go.

[Marcono1234]

Should probably have asked this earlier, but why are you providing custom POM files?
It appears the only difference is that the copy-rename-maven-plugin and proguard-maven-plugin have been removed. Was your intention to make building Gson more efficient because you are skipping the tests anyways?
(maybe you could then also run Maven only inside the gson/gson folder to avoid building the extras Maven module)

[eamonnmcmanus]

Actually I had a similar question. When I tried building with local sources it didn't work until I hacked at the pom.xml files to adjust things like the source and target levels.

[DavidKorczynski]

In short, I did this to make it build without issues.

The poms I added have the following changes from the original: change target/source levels and avoid the rename+proguard plugins.

I did this because I first ran into source number issues, which suggested I increase from 1.6 to 1.6. Then, I ran into the following issue when compiling the tests: /src/gson/gson/src/test/java/com/google/gson/internal/LinkedTreeMapTest.java:[164,20] Invalid java.lang.SafeVarargs annotation. Instance method <T>assertIterationOrd er(java.lang.Iterable<T>,T...) is not final.

and I ran into this issue when I skip tests:

[ERROR] Failed to execute goal com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1:rename (pre-obfuscate-class) on project gson: sourceFile /src/gson/gson/tar
get/test-classes/com/google/gson/functional/EnumWithObfuscatedTest.class does not exist 

As such, I moved forward from there until the errors didn't persist. Let me know if this complicates things in terms of adding false positives or similar.

Notice my knowledge of Maven is very limited.

[Marcono1234]

change target/source levels

Makes sense; your docker image is apparently using JDK 15, but Gson is compiled against Java 1.6 for which compilation support was dropped in JDK 12.
But hopefully future Gson versions will be compiled against at least Java 1.7 (see google/gson#2018) which is still supported by JDK 17.

avoid the rename+proguard plugins

The problem seems to be that you are building Gson with -Dmaven.test.skip=true, so even compilation of tests is disabled (see documentation). Therefore the copy-rename-maven-plugin which is needed for the tests fails. Unfortunately that plugin has no skip parameter or similar. I assume it could be solved for Gson by putting that plugin execution into a Maven profile which is enabled by default (and disabled when maven.test.skip=true), but not sure if that is worth it.

I am not familiar with how oss-fuzz or Jazzer works, but would it be an issue if the Gson tests were compiled (but not executed)? Then maybe you can remove these copies of the Gson POMs and run:

// Move into main Gson Maven module
cd gson
mvn clean package -DskipTests "-Dmaven.compiler.release=8"