[java] remove apache's commons-lang3 dependency (#659)

Our code pulls in the entire commons-lang3 dependency for just a single usage of the Pair class, which is trivial to implement ourselves. This commit removes the commons-lang3 dependency entirely and implements Pair as a private class which has drop-in replacement semantics for our usage in ColdWallet.java.
square · Jul 8, 2023 · b8bb79a · b8bb79a
1 parent 28072ad
commit b8bb79a
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 10 deletions.
diff --git a/java/gradle/verification-metadata.xml b/java/gradle/verification-metadata.xml
@@ -1044,14 +1044,6 @@
             <sha256 value="980d665d83fed04665134f0578e507442a0e750691073784391b0a7988724a75" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.apache.commons" name="commons-lang3" version="3.12.0">
-         <artifact name="commons-lang3-3.12.0.jar">
-            <sha256 value="d919d904486c037f8d193412da0c92e22a9fa24230b9d67a57855c5c31c7e94e" origin="Generated by Gradle"/>
-         </artifact>
-         <artifact name="commons-lang3-3.12.0.pom">
-            <sha256 value="82d31f1dcc4583effd744e979165b16da64bf86bca623fc5d1b03ed94f45c85a" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="org.apache.commons" name="commons-parent" version="51">
          <artifact name="commons-parent-51.pom">
             <sha256 value="9b779d18b22d8de559605558e7bb0a0a31b3f00c2abb9c878117c398aacabeca" origin="Generated by Gradle"/>

diff --git a/java/shared/build.gradle.kts b/java/shared/build.gradle.kts
@@ -12,7 +12,6 @@ dependencies {
     api("com.google.guava:guava:31.1-jre")
     api("com.google.zxing:core:3.5.0")
     api("com.madgag.spongycastle:core:1.58.0.0")
-    api("org.apache.commons:commons-lang3:3.12.0")
     api("org.bitcoinj:bitcoinj-core:0.16.1") {
         exclude("com.google.protobuf", "protobuf-javalite")
     }

diff --git a/java/shared/src/main/java/com/squareup/subzero/shared/ColdWallet.java b/java/shared/src/main/java/com/squareup/subzero/shared/ColdWallet.java
@@ -14,7 +14,6 @@
 import java.util.List;
 import java.util.stream.Collectors;
 import javax.annotation.Nullable;
-import org.apache.commons.lang3.tuple.Pair;
 import org.bitcoinj.core.Address;
 import org.bitcoinj.core.ECKey;
 import org.bitcoinj.core.NetworkParameters;
@@ -122,6 +121,31 @@ public byte[] createTransaction(List<TxInput> inputs, List<TxOutput> outputs,
         gateway, signatures, lockTime, sequence);
   }
 
+  /**
+   * Implement our own trivial Pair class so we don't have to pull in apache's entire commons-lang3 dependency.
+   */
+  private static final class Pair<L, R> {
+    private final L left;
+    private final R right;
+
+    private Pair(L left, R right) {
+      this.left = left;
+      this.right = right;
+    }
+
+    public static <L, R> Pair<L, R> of(L left, R right) {
+      return new Pair(left, right);
+    }
+
+    public L getLeft() {
+      return left;
+    }
+
+    public R getRight() {
+      return right;
+    }
+  }
+
   /**
    * Per OP_CHECKMULTISIG's documentation:
    * "Compares the first signature against each public key until it finds an ECDSA match. Starting