Remove dependency on Preconditions about googleauth HOT 7 CLOSED

Hi @ari,

It's not hidden: it was lost during a POM merge. I added it back to the develop branch yesterday, I'm going to merge it on release shortly.

The JAX-RS dependency is there because we use the URIBuilder class to perform some URI-encoding needed when generating the Google Chart API call. That dependency is marked as provided:

<dependency>
  <groupId>javax.ws.rs</groupId>
  <artifactId>javax.ws.rs-api</artifactId>
  <version>2.0.1</version>
  <scope>provided</scope>
</dependency>
<dependency>
  <groupId>org.glassfish.jersey.core</groupId>
  <artifactId>jersey-common</artifactId>
  <version>2.13</version>
  <scope>provided</scope>
</dependency>

When I wrote that part, using that class was by far the simplest method to get things done. If you are not executing this library on a Java EE container (6 or above), then you should provide both the API and the implementation in your classpath.

from googleauth.

I was thinking of forking your project to remove these dependencies for our own use. But also to then add https://github.com/kenglxn/QRGen because I am concerned about the security of passing the secret keys to Google.

Thanks for the very clearly written code by the way.

from googleauth.

The security concern is understandable: in fact, I added that as an ancillary facility to make things easy for Google Authenticator users. Into our own environments we don't even rely on QR codes to get things done. IMHO, I'd keep things separate: this library manages the creation and the validation of TOTP credentials. If you want to represent a secret key as a QR code or "put your favourite thing here", I'd do it externally.

If you want to remove Guava, it's fine: refactoring things will be really easy. I'm not going to drop it here (I just added it to the solution, in fact), because I think the source code readability greatly benefits from it (I acknowledge this is a very small library, though).

from googleauth.

@ari,

I've just pushed 0.4.1 with the updated POM.

I'm curious about why you want to remove Guava: is it because of its size?

from googleauth.

Well at first because it was a surprising dependency not in the pom. But then because I'm not sure I want a whole pile of extra code in our project to help with readability in a third party library (and from what I could see, that saves about 5 lines of code).

from googleauth.

Yeah, I use Guava almost in every project and I added almost automatically when I refactored those exceptions (because of related design choice in some EJBs of ours where we use this component).

You got your point: I'm going to drop it.

from googleauth.

@ari, dependency to Guava has been in GoogleAuth v. 0.4.2.

from googleauth.