SCANJLIB-324 Relocate bouncycastle to fix the conflict with versions already present on Gradle / AGP

[alban-auzeill]

---

Summary by Gitar

• Dependency Relocation:
  • Created bouncycastle-shaded module using maven-shade-plugin to repackage bcprov-jdk18on under org.sonarsource.scanner.lib.internal.impldep
  • Updated lib module dependencies and imports to use the shaded BouncyCastle artifact and package paths

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SCANJLIB-324

[gitar-bot]

Code Review ✅ Approved

Relocates bouncycastle into a shaded module to resolve classpath conflicts with Gradle and AGP. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[antoine-vinot-sonarsource]

Let's do it this way. It's not ideal but it looks like the best we can do in a reasonable time for now.

[antoine-vinot-sonarsource]

After the discussion we just had with @henryju it looks like this was tried before and lead to unexpected issues due to how bouncycastle uses reflection to solve providers

[henryju]

Suggested change

	<shadedPattern>org.sonarsource.scanner.lib.internal.impldep.org.bouncycastle</shadedPattern>
	<shadedPattern>shaded.org.bouncycastle</shadedPattern>

I this this is the usual pattern at Sonar (at least I remember seeing it a few times).