From b4b179aa07b89c91eebebabb30f9d5a1bc78b1c7 Mon Sep 17 00:00:00 2001
From: Thai Duong <thaidn@google.com>
Date: Fri, 19 May 2017 19:53:50 +0000
Subject: [PATCH] Merge "Using Bazel's default rules to generate full protos
 for Java and C++."

ORIGINAL_AUTHOR=Thai Duong <thaidn@google.com>
GitOrigin-RevId: 3989554f6b1639b744f7a188f5972f8f03d4ee79
---
 WORKSPACE                                     |  50 +-
 cc/BUILD                                      |  14 +-
 cc/aead/BUILD                                 |   4 +-
 cc/mac/BUILD                                  |   4 +-
 cc/subtle/BUILD                               |  14 +-
 cc/util/BUILD                                 |   2 +-
 java/BUILD                                    |   4 +-
 .../java/com/google/cloud/crypto/tink/BUILD   |  10 +-
 .../com/google/cloud/crypto/tink/aead/BUILD   |   8 +-
 .../com/google/cloud/crypto/tink/hybrid/BUILD |  12 +-
 .../com/google/cloud/crypto/tink/mac/BUILD    |   4 +-
 .../google/cloud/crypto/tink/signature/BUILD  |   4 +-
 proto/BUILD                                   | 310 +++++-----
 third_party/rules_protobuf/BUILD              |   5 +
 third_party/rules_protobuf/LICENSE            |  13 +
 third_party/rules_protobuf/README.md          |  10 +
 third_party/rules_protobuf/javalite/BUILD     |  40 ++
 third_party/rules_protobuf/javalite/deps.bzl  |  27 +
 third_party/rules_protobuf/javalite/rules.bzl |  78 +++
 third_party/rules_protobuf/protobuf/BUILD     |   3 +
 .../protobuf/internal/proto_compile.bzl       | 536 ++++++++++++++++++
 .../protobuf/internal/proto_language.bzl      |  91 +++
 .../protobuf/internal/proto_repositories.bzl  |  16 +
 .../protobuf/internal/require.bzl             |  77 +++
 third_party/rules_protobuf/protobuf/rules.bzl |   3 +
 third_party/rules_protobuf/tests/BUILD        |  24 +
 .../rules_protobuf/tests/message.proto        |   8 +
 .../tests/src/test/java/JavaLiteTest.java     |  36 ++
 tools/tinkey/BUILD                            |   2 +
 29 files changed, 1211 insertions(+), 198 deletions(-)
 create mode 100644 third_party/rules_protobuf/BUILD
 create mode 100644 third_party/rules_protobuf/LICENSE
 create mode 100644 third_party/rules_protobuf/README.md
 create mode 100644 third_party/rules_protobuf/javalite/BUILD
 create mode 100644 third_party/rules_protobuf/javalite/deps.bzl
 create mode 100644 third_party/rules_protobuf/javalite/rules.bzl
 create mode 100644 third_party/rules_protobuf/protobuf/BUILD
 create mode 100644 third_party/rules_protobuf/protobuf/internal/proto_compile.bzl
 create mode 100644 third_party/rules_protobuf/protobuf/internal/proto_language.bzl
 create mode 100644 third_party/rules_protobuf/protobuf/internal/proto_repositories.bzl
 create mode 100644 third_party/rules_protobuf/protobuf/internal/require.bzl
 create mode 100644 third_party/rules_protobuf/protobuf/rules.bzl
 create mode 100644 third_party/rules_protobuf/tests/BUILD
 create mode 100644 third_party/rules_protobuf/tests/message.proto
 create mode 100644 third_party/rules_protobuf/tests/src/test/java/JavaLiteTest.java

diff --git a/WORKSPACE b/WORKSPACE
index ed66614e9..c0781b0c2 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -1,11 +1,3 @@
-git_repository(
-  name = "org_pubref_rules_protobuf",
-  # This is a fork of https://github.com/pubref/rules_protobuf
-  # that removes gRPC and adds support for javalite.
-  remote = "https://github.com/thaidn/rules_protobuf",
-  commit = "812e9a0119712ffe0b125b806a1889797b4eaa02",
-)
-
 git_repository(
     name = "boringssl",
     commit = "e06766691547514e5bf756e4a0d926e8ca680e5a",
@@ -19,11 +11,45 @@ new_git_repository(
     build_file = "//tools:gtest.BUILD",
 )
 
-load("@org_pubref_rules_protobuf//java:rules.bzl", "java_proto_repositories")
-java_proto_repositories()
+load("//third_party/rules_protobuf/javalite:rules.bzl", "javalite_proto_repositories")
+javalite_proto_repositories()
+
+# proto_library rules implicitly depend on @com_google_protobuf//:protoc,
+# which is the proto-compiler.
+# This statement defines the @com_google_protobuf repo.
+http_archive(
+    name = "com_google_protobuf",
+    urls = ["https://github.com/google/protobuf/archive/b4b0e304be5a68de3d0ee1af9b286f958750f5e4.zip"],
+    strip_prefix = "protobuf-b4b0e304be5a68de3d0ee1af9b286f958750f5e4",
+    sha256 = "ff771a662fb6bd4d3cc209bcccedef3e93980a49f71df1e987f6afa3bcdcba3a",
+)
+
+# cc_proto_library rules implicitly depend on @com_google_protobuf_cc//:cc_toolchain,
+# which is the C++ proto runtime (base classes and common utilities).
+http_archive(
+    name = "com_google_protobuf_cc",
+    urls = ["https://github.com/google/protobuf/archive/b4b0e304be5a68de3d0ee1af9b286f958750f5e4.zip"],
+    strip_prefix = "protobuf-b4b0e304be5a68de3d0ee1af9b286f958750f5e4",
+    sha256 = "ff771a662fb6bd4d3cc209bcccedef3e93980a49f71df1e987f6afa3bcdcba3a",
+)
 
-load("@org_pubref_rules_protobuf//cpp:rules.bzl", "cpp_proto_repositories")
-cpp_proto_repositories()
+# java_proto_library rules implicitly depend on @com_google_protobuf_java//:java_toolchain,
+# which is the Java proto runtime (base classes and common utilities).
+http_archive(
+    name = "com_google_protobuf_java",
+    urls = ["https://github.com/google/protobuf/archive/b4b0e304be5a68de3d0ee1af9b286f958750f5e4.zip"],
+    strip_prefix = "protobuf-b4b0e304be5a68de3d0ee1af9b286f958750f5e4",
+    sha256 = "ff771a662fb6bd4d3cc209bcccedef3e93980a49f71df1e987f6afa3bcdcba3a",
+)
+
+# java_lite_proto_library rules implicitly depend on @com_google_protobuf_javalite//:javalite_toolchain,
+# which is the JavaLite proto runtime (base classes and common utilities).
+http_archive(
+    name = "com_google_protobuf_javalite",
+    urls = ["https://github.com/google/protobuf/archive/82809aaebf24fca3c2d5611149c78a3625bd3b70.zip"],
+    strip_prefix = "protobuf-82809aaebf24fca3c2d5611149c78a3625bd3b70",
+    sha256 = "75105f312cefd8aa5e0bdf29279dc8ef0a6f862362b321d35b1ed5c08ce2ecfb",
+)
 
 maven_jar(
     name = "args4j",
diff --git a/cc/BUILD b/cc/BUILD
index 579501148..27220dacb 100644
--- a/cc/BUILD
+++ b/cc/BUILD
@@ -29,7 +29,7 @@ cc_library(
         "//cc/util:statusor",
         "//cc/util:validation",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -39,7 +39,7 @@ cc_library(
     visibility = ["//visibility:public"],
     deps = [
         "//cc/util:statusor",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -50,7 +50,7 @@ cc_library(
     deps = [
         "//cc/util:status",
         "//cc/util:statusor",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -76,7 +76,7 @@ cc_library(
         "//cc/util:errors",
         "//cc/util:statusor",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -94,7 +94,7 @@ cc_library(
         "//cc/util:statusor",
         "//cc/util:validation",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -118,7 +118,7 @@ cc_library(
         "//cc/util:status",
         "//cc/util:statusor",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -166,7 +166,7 @@ cc_test(
         ":primitive_set",
         "//cc/util:test_util",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
         "@gtest//:gtest",
     ],
 )
diff --git a/cc/aead/BUILD b/cc/aead/BUILD
index 8ee0609ca..dc6460615 100644
--- a/cc/aead/BUILD
+++ b/cc/aead/BUILD
@@ -12,7 +12,7 @@ cc_library(
         "//cc/util:status",
         "//cc/util:statusor",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -51,7 +51,7 @@ cc_library(
         "//proto:aes_gcm_cc_proto",
         "//proto:common_cc_proto",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
diff --git a/cc/mac/BUILD b/cc/mac/BUILD
index 71a548a14..a64f54c03 100644
--- a/cc/mac/BUILD
+++ b/cc/mac/BUILD
@@ -30,7 +30,7 @@ cc_library(
         "//cc:registry",
         "//cc/util:status",
         "//cc/util:statusor",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -51,7 +51,7 @@ cc_library(
         "//proto:common_cc_proto",
         "//proto:hmac_cc_proto",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
diff --git a/cc/subtle/BUILD b/cc/subtle/BUILD
index 66de39a7d..05035d854 100644
--- a/cc/subtle/BUILD
+++ b/cc/subtle/BUILD
@@ -13,7 +13,7 @@ cc_library(
         "//cc/util:statusor",
         "//proto:common_cc_proto",
         "@boringssl//:crypto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -28,7 +28,7 @@ cc_library(
         "//cc/util:statusor",
         "//proto:common_cc_proto",
         "@boringssl//:crypto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -42,7 +42,7 @@ cc_library(
         "//cc/util:statusor",
         "//proto:common_cc_proto",
         "@boringssl//:crypto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -57,7 +57,7 @@ cc_library(
         "//cc/util:statusor",
         "//proto:common_cc_proto",
         "@boringssl//:crypto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -74,7 +74,7 @@ cc_library(
         "//cc/util:test_util",
         "//proto:common_cc_proto",
         "@boringssl//:crypto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -91,7 +91,7 @@ cc_library(
         "//cc/util:test_util",
         "//proto:common_cc_proto",
         "@boringssl//:crypto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
@@ -114,7 +114,7 @@ cc_library(
         "//cc/util:statusor",
         "//proto:common_cc_proto",
         "@boringssl//:crypto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
diff --git a/cc/util/BUILD b/cc/util/BUILD
index 3f0a14e1f..e1836d546 100644
--- a/cc/util/BUILD
+++ b/cc/util/BUILD
@@ -47,7 +47,7 @@ cc_library(
         "//cc:aead",
         "//cc:mac",
         "//proto:tink_cc_proto",
-        "@com_github_google_protobuf//:protobuf_lite",
+        "@com_google_protobuf//:protobuf_lite",
     ],
 )
 
diff --git a/java/BUILD b/java/BUILD
index 9e283459b..9bca1b8b2 100644
--- a/java/BUILD
+++ b/java/BUILD
@@ -49,6 +49,7 @@ java_library(
     ],
     exports = [
         "//proto:aes_ctr_hmac_aead_java_proto",
+        "//proto:aes_ctr_java_proto",
         "//proto:aes_eax_java_proto",
         "//proto:aes_gcm_java_proto",
         "//proto:common_java_proto",
@@ -58,7 +59,6 @@ java_library(
         "//proto:hmac_java_proto",
         "//proto:kms_envelope_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
     ],
 )
 
@@ -141,6 +141,7 @@ java_library(
     deps = [
         ":testonly",
         "@com_google_guava//jar",
+        "@com_google_protobuf_java//:protobuf_java",
         "@junit_junit_4//jar",
     ],
 )
@@ -163,6 +164,7 @@ java_library(
         "@com_fasterxml_jackson_core//jar",
         "@com_google_api_client//jar",
         "@com_google_guava//jar",
+        "@com_google_protobuf_java//:protobuf_java",
         "@com_google_truth//jar",
         "@junit_junit_4//jar",
     ],
diff --git a/java/src/main/java/com/google/cloud/crypto/tink/BUILD b/java/src/main/java/com/google/cloud/crypto/tink/BUILD
index f31b24887..b1155ca7b 100644
--- a/java/src/main/java/com/google/cloud/crypto/tink/BUILD
+++ b/java/src/main/java/com/google/cloud/crypto/tink/BUILD
@@ -72,7 +72,7 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//proto:common_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -84,7 +84,7 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//proto:common_java_proto_lite",
         "//proto:tink_java_proto_lite",
-        "//proto:tink_java_proto_lite_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -98,7 +98,7 @@ java_library(
         ":tink",
         "//proto:common_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -112,7 +112,7 @@ java_library(
         ":tink",
         "//proto:common_java_proto_lite",
         "//proto:tink_java_proto_lite",
-        "//proto:tink_java_proto_lite_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -127,7 +127,7 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//proto:common_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
         "@com_google_guava//jar",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
diff --git a/java/src/main/java/com/google/cloud/crypto/tink/aead/BUILD b/java/src/main/java/com/google/cloud/crypto/tink/aead/BUILD
index 3ab5b6427..3c17eb411 100644
--- a/java/src/main/java/com/google/cloud/crypto/tink/aead/BUILD
+++ b/java/src/main/java/com/google/cloud/crypto/tink/aead/BUILD
@@ -35,13 +35,14 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle:aead",
         "//proto:aes_ctr_hmac_aead_java_proto",
+        "//proto:aes_ctr_java_proto",
         "//proto:aes_eax_java_proto",
         "//proto:aes_gcm_java_proto",
         "//proto:common_java_proto",
         "//proto:hmac_java_proto",
         "//proto:kms_envelope_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -55,13 +56,14 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle:aead",
         "//proto:aes_ctr_hmac_aead_java_proto_lite",
+        "//proto:aes_ctr_java_proto_lite",
         "//proto:aes_eax_java_proto_lite",
         "//proto:aes_gcm_java_proto_lite",
         "//proto:common_java_proto_lite",
         "//proto:hmac_java_proto_lite",
         "//proto:kms_envelope_java_proto_lite",
         "//proto:tink_java_proto_lite",
-        "//proto:tink_java_proto_lite_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -77,11 +79,11 @@ java_library(
         "//proto:common_java_proto",
         "//proto:gcp_kms_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
         "@com_google_api_client//jar",
         "@com_google_cloudkms//jar",
         "@com_google_http_client//jar",
         "@com_google_http_client_jackson2//jar",
         "@com_google_oauth_client//jar",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
diff --git a/java/src/main/java/com/google/cloud/crypto/tink/hybrid/BUILD b/java/src/main/java/com/google/cloud/crypto/tink/hybrid/BUILD
index 55de72979..d304e3b93 100644
--- a/java/src/main/java/com/google/cloud/crypto/tink/hybrid/BUILD
+++ b/java/src/main/java/com/google/cloud/crypto/tink/hybrid/BUILD
@@ -35,12 +35,13 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle:hybrid",
         "//proto:aes_ctr_hmac_aead_java_proto",
+        "//proto:aes_ctr_java_proto",
         "//proto:aes_gcm_java_proto",
         "//proto:common_java_proto",
         "//proto:ecies_aead_hkdf_java_proto",
         "//proto:hmac_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -57,12 +58,13 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle:hybrid",
         "//proto:aes_ctr_hmac_aead_java_proto_lite",
+        "//proto:aes_ctr_java_proto_lite",
         "//proto:aes_gcm_java_proto_lite",
         "//proto:common_java_proto_lite",
         "//proto:ecies_aead_hkdf_java_proto_lite",
         "//proto:hmac_java_proto_lite",
         "//proto:tink_java_proto_lite",
-        "//proto:tink_java_proto_lite_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -90,12 +92,13 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle:hybrid",
         "//proto:aes_ctr_hmac_aead_java_proto",
+        "//proto:aes_ctr_java_proto",
         "//proto:aes_gcm_java_proto",
         "//proto:common_java_proto",
         "//proto:ecies_aead_hkdf_java_proto",
         "//proto:hmac_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -112,11 +115,12 @@ java_library(
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle",
         "//java/src/main/java/com/google/cloud/crypto/tink/subtle:hybrid",
         "//proto:aes_ctr_hmac_aead_java_proto_lite",
+        "//proto:aes_ctr_java_proto_lite",
         "//proto:aes_gcm_java_proto_lite",
         "//proto:common_java_proto_lite",
         "//proto:ecies_aead_hkdf_java_proto_lite",
         "//proto:hmac_java_proto_lite",
         "//proto:tink_java_proto_lite",
-        "//proto:tink_java_proto_lite_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
diff --git a/java/src/main/java/com/google/cloud/crypto/tink/mac/BUILD b/java/src/main/java/com/google/cloud/crypto/tink/mac/BUILD
index a57d95a9f..f83cb4150 100644
--- a/java/src/main/java/com/google/cloud/crypto/tink/mac/BUILD
+++ b/java/src/main/java/com/google/cloud/crypto/tink/mac/BUILD
@@ -31,7 +31,7 @@ java_library(
         "//proto:common_java_proto",
         "//proto:hmac_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -46,6 +46,6 @@ java_library(
         "//proto:common_java_proto_lite",
         "//proto:hmac_java_proto_lite",
         "//proto:tink_java_proto_lite",
-        "//proto:tink_java_proto_lite_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
diff --git a/java/src/main/java/com/google/cloud/crypto/tink/signature/BUILD b/java/src/main/java/com/google/cloud/crypto/tink/signature/BUILD
index 370c832e4..dc90ca562 100644
--- a/java/src/main/java/com/google/cloud/crypto/tink/signature/BUILD
+++ b/java/src/main/java/com/google/cloud/crypto/tink/signature/BUILD
@@ -31,7 +31,7 @@ java_library(
         "//proto:common_java_proto",
         "//proto:ecdsa_java_proto",
         "//proto:tink_java_proto",
-        "//proto:tink_java_proto_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -46,6 +46,6 @@ java_library(
         "//proto:common_java_proto_lite",
         "//proto:ecdsa_java_proto_lite",
         "//proto:tink_java_proto_lite",
-        "//proto:tink_java_proto_lite_compile_imports",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
diff --git a/proto/BUILD b/proto/BUILD
index 901b33088..01385e4b8 100644
--- a/proto/BUILD
+++ b/proto/BUILD
@@ -7,28 +7,28 @@ package(
 
 licenses(["notice"])  # Apache 2.0
 
-load("@org_pubref_rules_protobuf//cpp:rules.bzl", "cc_proto_library")
-load("@org_pubref_rules_protobuf//java:rules.bzl", "java_proto_library", "java_lite_proto_library")
+load("//third_party/rules_protobuf/javalite:rules.bzl", "java_lite_proto_library")
 
 # common
-cc_proto_library(
-    name = "common_cc_proto",
-    protos = [
+proto_library(
+    name = "common",
+    srcs = [
         "common.proto",
     ],
-    verbose = 0,
 )
 
-java_lite_proto_library(
-    name = "common_java_proto_lite",
-    protos = [
-        "common.proto",
-    ],
-    verbose = 0,
+cc_proto_library(
+    name = "common_cc_proto",
+    deps = [":common"],
 )
 
 java_proto_library(
     name = "common_java_proto",
+    deps = [":common"],
+)
+
+java_lite_proto_library(
+    name = "common_java_proto_lite",
     protos = [
         "common.proto",
     ],
@@ -36,15 +36,24 @@ java_proto_library(
 )
 
 # tink
-cc_proto_library(
-    name = "tink_cc_proto",
-    inputs = [
-        ":common_cc_proto",
-    ],
-    protos = [
+proto_library(
+    name = "tink",
+    srcs = [
         "tink.proto",
     ],
-    verbose = 0,
+    deps = [
+        ":common",
+    ],
+)
+
+cc_proto_library(
+    name = "tink_cc_proto",
+    deps = [":tink"],
+)
+
+java_proto_library(
+    name = "tink_java_proto",
+    deps = [":tink"],
 )
 
 java_lite_proto_library(
@@ -58,27 +67,25 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "tink_java_proto",
-    inputs = [
-        ":common_java_proto",
+# ecdsa
+proto_library(
+    name = "ecdsa",
+    srcs = [
+        "ecdsa.proto",
     ],
-    protos = [
-        "tink.proto",
+    deps = [
+        ":common",
     ],
-    verbose = 0,
 )
 
-# ecdsa
 cc_proto_library(
     name = "ecdsa_cc_proto",
-    proto_deps = [
-        ":common_cc_proto",
-    ],
-    protos = [
-        "ecdsa.proto",
-    ],
-    verbose = 0,
+    deps = [":ecdsa"],
+)
+
+java_proto_library(
+    name = "ecdsa_java_proto",
+    deps = [":ecdsa"],
 )
 
 java_lite_proto_library(
@@ -92,24 +99,22 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "ecdsa_java_proto",
-    proto_deps = [
-        ":common_java_proto",
-    ],
-    protos = [
-        "ecdsa.proto",
+# ed25519
+proto_library(
+    name = "ed25519",
+    srcs = [
+        "ed25519.proto",
     ],
-    verbose = 0,
 )
 
-# ed25519
 cc_proto_library(
     name = "ed25519_cc_proto",
-    protos = [
-        "ed25519.proto",
-    ],
-    verbose = 0,
+    deps = [":ed25519"],
+)
+
+java_proto_library(
+    name = "ed25519_java_proto",
+    deps = [":ed25519"],
 )
 
 java_lite_proto_library(
@@ -120,24 +125,23 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "ed25519_java_proto",
-    protos = [
-        "ed25519.proto",
+# hmac
+proto_library(
+    name = "hmac",
+    srcs = [
+        "hmac.proto",
     ],
-    verbose = 0,
+    deps = [":common"],
 )
 
-# hmac
 cc_proto_library(
     name = "hmac_cc_proto",
-    proto_deps = [
-        ":common_cc_proto",
-    ],
-    protos = [
-        "hmac.proto",
-    ],
-    verbose = 0,
+    deps = [":hmac"],
+)
+
+java_proto_library(
+    name = "hmac_java_proto",
+    deps = [":hmac"],
 )
 
 java_lite_proto_library(
@@ -151,29 +155,52 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "hmac_java_proto",
-    proto_deps = [
-        ":common_java_proto",
+# aes_ctr
+proto_library(
+    name = "aes_ctr",
+    srcs = [
+        "aes_ctr.proto",
     ],
+)
+
+cc_proto_library(
+    name = "aes_ctr_cc_proto",
+    deps = [":aes_ctr"],
+)
+
+java_proto_library(
+    name = "aes_ctr_java_proto",
+    deps = [":aes_ctr"],
+)
+
+java_lite_proto_library(
+    name = "aes_ctr_java_proto_lite",
     protos = [
-        "hmac.proto",
+        "aes_ctr.proto",
     ],
     verbose = 0,
 )
 
 # aes_ctr_hmac_aead
-cc_proto_library(
-    name = "aes_ctr_hmac_aead_cc_proto",
-    proto_deps = [
-        ":common_cc_proto",
-        ":hmac_cc_proto",
-    ],
-    protos = [
-        "aes_ctr.proto",
+proto_library(
+    name = "aes_ctr_hmac_aead",
+    srcs = [
         "aes_ctr_hmac_aead.proto",
     ],
-    verbose = 0,
+    deps = [
+        ":aes_ctr",
+        ":hmac",
+    ],
+)
+
+cc_proto_library(
+    name = "aes_ctr_hmac_aead_cc_proto",
+    deps = [":aes_ctr_hmac_aead"],
+)
+
+java_proto_library(
+    name = "aes_ctr_hmac_aead_java_proto",
+    deps = [":aes_ctr_hmac_aead"],
 )
 
 java_lite_proto_library(
@@ -189,26 +216,22 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "aes_ctr_hmac_aead_java_proto",
-    proto_deps = [
-        ":common_java_proto",
-        ":hmac_java_proto",
-    ],
-    protos = [
-        "aes_ctr.proto",
-        "aes_ctr_hmac_aead.proto",
+# aes_gcm
+proto_library(
+    name = "aes_gcm",
+    srcs = [
+        "aes_gcm.proto",
     ],
-    verbose = 0,
 )
 
-# aes_gcm
 cc_proto_library(
     name = "aes_gcm_cc_proto",
-    protos = [
-        "aes_gcm.proto",
-    ],
-    verbose = 0,
+    deps = [":aes_gcm"],
+)
+
+java_proto_library(
+    name = "aes_gcm_java_proto",
+    deps = [":aes_gcm"],
 )
 
 java_lite_proto_library(
@@ -219,21 +242,22 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "aes_gcm_java_proto",
-    protos = [
-        "aes_gcm.proto",
+# aes_eax
+proto_library(
+    name = "aes_eax",
+    srcs = [
+        "aes_eax.proto",
     ],
-    verbose = 0,
 )
 
-# aes_eax
 cc_proto_library(
     name = "aes_eax_cc_proto",
-    protos = [
-        "aes_eax.proto",
-    ],
-    verbose = 0,
+    deps = [":aes_eax"],
+)
+
+java_proto_library(
+    name = "aes_eax_java_proto",
+    deps = [":aes_eax"],
 )
 
 java_lite_proto_library(
@@ -244,21 +268,22 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "aes_eax_java_proto",
-    protos = [
-        "aes_eax.proto",
+# gcp_kms
+proto_library(
+    name = "gcp_kms",
+    srcs = [
+        "gcp_kms.proto",
     ],
-    verbose = 0,
 )
 
-# gcp_kms
 cc_proto_library(
     name = "gcp_kms_cc_proto",
-    protos = [
-        "gcp_kms.proto",
-    ],
-    verbose = 0,
+    deps = [":gcp_kms"],
+)
+
+java_proto_library(
+    name = "gcp_kms_java_proto",
+    deps = [":gcp_kms"],
 )
 
 java_lite_proto_library(
@@ -269,24 +294,23 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "gcp_kms_java_proto",
-    protos = [
-        "gcp_kms.proto",
+# kms_envelope
+proto_library(
+    name = "kms_envelope",
+    srcs = [
+        "kms_envelope.proto",
     ],
-    verbose = 0,
+    deps = [":tink"],
 )
 
-# kms_envelope
 cc_proto_library(
     name = "kms_envelope_cc_proto",
-    proto_deps = [
-        ":tink_cc_proto",
-    ],
-    protos = [
-        "kms_envelope.proto",
-    ],
-    verbose = 0,
+    deps = [":kms_envelope"],
+)
+
+java_proto_library(
+    name = "kms_envelope_java_proto",
+    deps = [":kms_envelope"],
 )
 
 java_lite_proto_library(
@@ -300,28 +324,26 @@ java_lite_proto_library(
     verbose = 0,
 )
 
-java_proto_library(
-    name = "kms_envelope_java_proto",
-    proto_deps = [
-        ":tink_java_proto",
+# ECIES hybrid encryption with AEAD and HKDF
+proto_library(
+    name = "ecies_aead_hkdf",
+    srcs = [
+        "ecies_aead_hkdf.proto",
     ],
-    protos = [
-        "kms_envelope.proto",
+    deps = [
+        ":common",
+        ":tink",
     ],
-    verbose = 0,
 )
 
-# ECIES hybrid encryption with AEAD and HKDF
 cc_proto_library(
     name = "ecies_aead_hkdf_cc_proto",
-    proto_deps = [
-        ":common_cc_proto",
-        ":tink_cc_proto",
-    ],
-    protos = [
-        "ecies_aead_hkdf.proto",
-    ],
-    verbose = 0,
+    deps = [":ecies_aead_hkdf"],
+)
+
+java_proto_library(
+    name = "ecies_aead_hkdf_java_proto",
+    deps = [":ecies_aead_hkdf"],
 )
 
 java_lite_proto_library(
@@ -335,15 +357,3 @@ java_lite_proto_library(
     ],
     verbose = 0,
 )
-
-java_proto_library(
-    name = "ecies_aead_hkdf_java_proto",
-    proto_deps = [
-        ":common_java_proto",
-        ":tink_java_proto",
-    ],
-    protos = [
-        "ecies_aead_hkdf.proto",
-    ],
-    verbose = 0,
-)
diff --git a/third_party/rules_protobuf/BUILD b/third_party/rules_protobuf/BUILD
new file mode 100644
index 000000000..0988550c0
--- /dev/null
+++ b/third_party/rules_protobuf/BUILD
@@ -0,0 +1,5 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache 2.0
+
+exports_files(["LICENSE"])
diff --git a/third_party/rules_protobuf/LICENSE b/third_party/rules_protobuf/LICENSE
new file mode 100644
index 000000000..29d600b08
--- /dev/null
+++ b/third_party/rules_protobuf/LICENSE
@@ -0,0 +1,13 @@
+Copyright 2016 PubRef.org
+
+Licensed under the Apache License, Version 2.0 (the "License"); you
+may not use this file except in compliance with the License.  You may
+obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied.  See the License for the specific language governing
+permissions and limitations under the License.
diff --git a/third_party/rules_protobuf/README.md b/third_party/rules_protobuf/README.md
new file mode 100644
index 000000000..e46e6d9e1
--- /dev/null
+++ b/third_party/rules_protobuf/README.md
@@ -0,0 +1,10 @@
+# Bazel Skylark rules for building lite protos for Java
+
+This is a minimal fork of [Rules Protobuf](https://github.com/pubref/rules_protobuf)
+that supports generating lite protos for Java.
+
+Tink needs temporarily depend on these rules because java_lite_proto_library is
+not working properly. See https://github.com/cgrushko/proto_library/issues/1.
+
+Once either Bazel or Protobuf team fixes java_lite_proto_library, these rules
+can be removed.
diff --git a/third_party/rules_protobuf/javalite/BUILD b/third_party/rules_protobuf/javalite/BUILD
new file mode 100644
index 000000000..5bfcfeead
--- /dev/null
+++ b/third_party/rules_protobuf/javalite/BUILD
@@ -0,0 +1,40 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache 2.0
+
+load("//third_party/rules_protobuf/protobuf:rules.bzl", "proto_language", "proto_language_deps")
+
+proto_language(
+    name = "javalite",
+    output_to_jar = True,
+    pb_compile_deps = [
+        "@com_google_protobuf_java//:protobuf_java",
+    ],
+    pb_file_extensions = [],
+    pb_plugin = ":protoc_gen_javalite_bin",
+    pb_runtime_deps = [],
+)
+
+genrule(
+    name = "protoc_gen_javalite_bin",
+    srcs = select({
+        ":darwin": ["@protoc_gen_javalite_macosx//file"],
+        "//conditions:default": ["@protoc_gen_javalite_linux_x86_64//file"],
+    }),
+    outs = ["protoc_gen_javalite"],
+    cmd = " && ".join([
+        "IN=$$(pwd)/$(SRCS)",
+        "OUT=$$(pwd)/$@",
+        "TMP=$$(mktemp -d $${TMPDIR:-/tmp}/genrule.XXXXXXXXXX)",
+        "cd $$TMP",
+        "cp $$IN $$OUT",
+        "rm -rf $$TMP",
+    ]),
+    executable = True,
+)
+
+config_setting(
+    name = "darwin",
+    values = {"cpu": "darwin"},
+    visibility = ["//visibility:private"],
+)
diff --git a/third_party/rules_protobuf/javalite/deps.bzl b/third_party/rules_protobuf/javalite/deps.bzl
new file mode 100644
index 000000000..7533085ba
--- /dev/null
+++ b/third_party/rules_protobuf/javalite/deps.bzl
@@ -0,0 +1,27 @@
+# MAINTAINERS
+#
+# Every external rule must have a SHA checksum or tag.
+#
+# To update http_file(s) from maven servers, point your browser to
+# https://repo1.maven.org/maven2/com/google/protobuf/protoc, find the
+# file, copy it down to your workstation (with curl perhaps), and
+# compute the sha256:
+#
+# $ curl -O -J -L https://repo1.maven.org/maven2/com/google/protobuf/protoc/3.0.0/protoc-3.0.0-linux-x86_64.exe
+# $ sha256sum protoc-3.0.0-linux-x86_64.exe #linux
+# $ shasum -a256 protoc-3.0.0-osx-x86_64.exe # macosx
+#
+
+DEPS = {
+    "protoc_gen_javalite_linux_x86_64": {
+        "rule": "http_file",
+        "url" : "http://repo1.maven.org/maven2/com/google/protobuf/protoc-gen-javalite/3.0.0/protoc-gen-javalite-3.0.0-linux-x86_64.exe",
+        "sha256": "83eb6ee8391cbd26ebf48f6636c089e530fd3fea454dc66e5a7e36a648795c7b",
+    },
+
+    "protoc_gen_javalite_macosx": {
+        "rule": "http_file",
+        "url" : "http://repo1.maven.org/maven2/com/google/protobuf/protoc-gen-javalite/3.0.0/protoc-gen-javalite-3.0.0-osx-x86_64.exe",
+        "sha256": "fe6f2ba6c6550f20cfa4d07e481a19ce108981009fdd7e6819fed9caa70af074",
+    },
+}
diff --git a/third_party/rules_protobuf/javalite/rules.bzl b/third_party/rules_protobuf/javalite/rules.bzl
new file mode 100644
index 000000000..144ee4649
--- /dev/null
+++ b/third_party/rules_protobuf/javalite/rules.bzl
@@ -0,0 +1,78 @@
+load("//third_party/rules_protobuf/javalite:deps.bzl", "DEPS")
+
+load("//third_party/rules_protobuf/protobuf:rules.bzl",
+     "proto_compile",
+     "proto_language",
+     "proto_language_deps",
+     "proto_repositories")
+
+def javalite_proto_repositories(
+    lang_deps = DEPS,
+    lang_requires = [
+      "protoc_gen_javalite_linux_x86_64",
+      "protoc_gen_javalite_macosx",
+    ],
+    **kwargs):
+
+  proto_repositories(lang_deps = lang_deps,
+                     lang_requires = lang_requires,
+                     **kwargs)
+
+def java_lite_proto_library(
+    name,
+    langs = [str(Label("//third_party/rules_protobuf/javalite:javalite"))],
+    protos = [],
+    imports = [],
+    inputs = [],
+    output_to_workspace = False,
+    proto_deps = [],
+    protoc = None,
+
+    pb_plugin = None,
+    pb_options = [],
+
+    proto_compile_args = {},
+    srcs = [],
+    deps = [],
+    verbose = 0,
+    **kwargs):
+
+  proto_compile_args += {
+    "name": name + ".pb",
+    "protos": protos,
+    "deps": [dep + ".pb" for dep in proto_deps],
+    "langs": langs,
+    "imports": imports,
+    "inputs": inputs,
+    "pb_options": pb_options,
+    "output_to_workspace": output_to_workspace,
+    "verbose": verbose,
+  }
+
+  if protoc:
+    proto_compile_args["protoc"] = protoc
+  if pb_plugin:
+    proto_compile_args["pb_plugin"] = pb_plugin
+
+  proto_compile(**proto_compile_args)
+
+  proto_language_deps(
+    name = name + "_compile_deps",
+    langs = langs,
+    file_extensions = [".jar"],
+  )
+
+  native.java_import(
+    name = name + "_compile_imports",
+    jars = [name + "_compile_deps"],
+  )
+
+  java_exports = []
+
+  native.java_library(
+    name = name,
+    srcs = srcs + [name + ".pb"],
+    javacopts = ['-extra_checks:off'], # need this to disable ErrorProne.
+    exports = java_exports,
+    deps = list(set(deps + proto_deps + [name + "_compile_imports"])),
+    **kwargs)
diff --git a/third_party/rules_protobuf/protobuf/BUILD b/third_party/rules_protobuf/protobuf/BUILD
new file mode 100644
index 000000000..f631b6df0
--- /dev/null
+++ b/third_party/rules_protobuf/protobuf/BUILD
@@ -0,0 +1,3 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache 2.0
diff --git a/third_party/rules_protobuf/protobuf/internal/proto_compile.bzl b/third_party/rules_protobuf/protobuf/internal/proto_compile.bzl
new file mode 100644
index 000000000..97e140f7c
--- /dev/null
+++ b/third_party/rules_protobuf/protobuf/internal/proto_compile.bzl
@@ -0,0 +1,536 @@
+def _capitalize(s):
+  return s[0:1].upper() + s[1:]
+
+
+def _pascal_case(s):
+  return "".join([_capitalize(part) for part in s.split("_")])
+
+
+def _emit_params_file_action(ctx, path, mnemonic, cmds):
+  """Helper function that writes a potentially long command list to a file.
+  Args:
+    ctx (struct): The ctx object.
+    path (string): the file path where the params file should be written.
+    mnemonic (string): the action mnemomic.
+    cmds (list<string>): the command list.
+  Returns:
+    (File): an executable file that runs the command set.
+  """
+  filename = "%s.%sFile.params" % (path, mnemonic)
+  f = ctx.new_file(ctx.configuration.bin_dir, filename)
+  ctx.file_action(output = f,
+                  content = "\n".join(["set -e"] + cmds),
+                  executable = True)
+  return f
+
+
+def _get_relative_dirname(base, file):
+  """Return a dirname in the form of path segments relative to base.
+  If the file.short_path is not within base, return empty list.
+  Example: if base="foo/bar/baz.txt"
+           and file.short_path="bar/baz.txt",
+           return ["bar"].
+  Args:
+    base (string): the base dirname (ctx.label.package)
+    file (File): the file to calculate relative dirname.
+  Returns:
+    (list<string>): path
+  """
+  path = file.dirname
+  if not path.startswith(base):
+    return []
+  parts = path.split("/")
+  if parts[0] == "external":
+    # ignore off the first two items since we'll be cd'ing into
+    # this dir.
+    return parts[2:]
+  base_parts = base.split("/")
+  return parts[len(base_parts):]
+
+
+def _get_offset_path(root, path):
+  """Adjust path relative to offset"""
+
+  if path.startswith("/"):
+    fail("path argument must not be absolute: %s" % path)
+
+  if not root:
+    return path
+
+  if root == ".":
+    return path
+
+  # "external/foobar/file.proto" --> "file.proto"
+  if path.startswith(root):
+    start = len(root)
+    if not root.endswith('/'):
+      start += 1
+      return path[start:]
+
+  depth = root.count('/') + 1
+  return "../" * depth + path
+
+
+def _get_import_mappings_for(files, prefix, label):
+  """For a set of files that belong the the given context label, create a mapping to the given prefix."""
+
+  mappings = {}
+  for file in files:
+    src = file.short_path
+    # File in an external repo looks like:
+    # '../WORKSPACE/SHORT_PATH'.  We want just the SHORT_PATH.
+    if src.startswith("../"):
+      parts = src.split("/")
+      src = "/".join(parts[2:])
+    dst = [prefix, label.package]
+    name_parts = label.name.split(".")
+    # special case to elide last part if the name is
+    # 'go_default_library.pb'
+    if name_parts[0] != "go_default_library":
+      dst.append(name_parts[0])
+    mappings[src] = "/".join(dst)
+
+  return mappings
+
+
+def _build_output_jar(run, builder):
+  """Build a jar file for protoc to dump java classes into."""
+  ctx = run.ctx
+  execdir = run.data.execdir
+  name = run.lang.name
+  protojar = ctx.new_file("%s_%s.jar" % (run.data.label.name, name))
+  builder["outputs"] += [protojar]
+  builder[name + "_jar"] = protojar
+  builder[name + "_outdir"] = _get_offset_path(execdir, protojar.path)
+
+
+def _build_output_library(run, builder):
+  """Build a library.js file for protoc to dump java classes into."""
+  ctx = run.ctx
+  execdir = run.data.execdir
+  name = run.lang.name
+  jslib = ctx.new_file(run.data.label.name + run.lang.pb_file_extensions[0])
+  builder["jslib"] = [jslib]
+  builder["outputs"] += [jslib]
+
+  parts = jslib.short_path.rpartition("/")
+  filename = "/".join([parts[0], run.data.label.name])
+  library_path = _get_offset_path(run.data.execdir, filename)
+  builder[name + "_pb_options"] += ["library=" + library_path]
+
+
+def _build_output_srcjar(run, builder):
+  ctx = run.ctx
+  name = run.lang.name
+  protojar = builder[name + "_jar"]
+  srcjar_name = "%s_%s.srcjar" % (run.data.label.name, name)
+  srcjar = ctx.new_file("%s_%s.srcjar" % (run.data.label.name, name))
+  run.ctx.action(
+    mnemonic = "CpJarToSrcJar",
+    inputs = [protojar],
+    outputs = [srcjar],
+    arguments = [protojar.path, srcjar.path],
+    command = "cp $1 $2",
+  )
+
+  # Remove protojar from the list of provided outputs
+  builder["outputs"] = [e for e in builder["outputs"] if e != protojar]
+  builder["outputs"] += [srcjar]
+
+  if run.data.verbose > 2:
+    print("Copied jar %s srcjar to %s" % (protojar.path, srcjar.path))
+
+def _build_output_files(run, builder):
+  """Build a list of files we expect to be generated."""
+
+  ctx = run.ctx
+  protos = run.data.protos
+  if not protos:
+    fail("Empty proto input list.", "protos")
+
+  exts = run.exts
+
+  for file in protos:
+    base = file.basename[:-len(".proto")]
+    if run.lang.output_file_style == 'pascal':
+      base = _pascal_case(base)
+    if run.lang.output_file_style == 'capitalize':
+      base = _capitalize(base)
+    for ext in exts:
+      path = _get_relative_dirname(ctx.label.package, file)
+      path.append(base + ext)
+      pbfile = ctx.new_file("/".join(path))
+      builder["outputs"] += [pbfile]
+
+
+def _build_output_libdir(run, builder):
+  # This is currently csharp-specific, which needs to have the
+  # output_dir positively adjusted to the package directory.
+  ctx = run.ctx
+  execdir = run.data.execdir
+  name = run.lang.name
+  builder[name + "_outdir"] = _get_offset_path(execdir, run.data.descriptor_set.dirname)
+  _build_output_files(run, builder)
+
+
+def _build_descriptor_set(data, builder):
+  """Build a list of files we expect to be generated."""
+  builder["args"] += ["--descriptor_set_out=" + _get_offset_path(data.execdir, data.descriptor_set.path)]
+
+
+def _build_plugin_invocation(name, plugin, execdir, builder):
+  """Add a '--plugin=NAME=PATH' argument if the language descriptor
+  requires one.
+  """
+  tool = _get_offset_path(execdir, plugin.path)
+  builder["inputs"] += [plugin]
+  builder["args"] += ["--plugin=protoc-gen-%s=%s" % (name, tool)]
+
+
+def _build_protobuf_invocation(run, builder):
+  """Build a --plugin option if required for basic protobuf generation.
+  Args:
+    run (struct): the compilation run object.
+    builder (dict): the compilation builder data.
+  Built-in language don't need this.
+  """
+  lang = run.lang
+  if not lang.pb_plugin:
+    return
+  name = lang.pb_plugin_name or lang.name
+  _build_plugin_invocation(name,
+                           lang.pb_plugin,
+                           run.data.execdir,
+                           builder)
+
+
+
+def _get_mappings(files, label, prefix):
+  """For a set of files that belong the the given context label, create a mapping to the given prefix."""
+  mappings = {}
+  for file in files:
+    src = file.short_path
+    #print("mapping file short path: %s" % src)
+    # File in an external repo looks like:
+    # '../WORKSPACE/SHORT_PATH'.  We want just the SHORT_PATH.
+    if src.startswith("../"):
+      parts = src.split("/")
+      src = "/".join(parts[2:])
+    dst = [prefix]
+    if label.package:
+      dst.append(label.package)
+    name_parts = label.name.split(".")
+    # special case to elide last part if the name is
+    # 'go_default_library.pb'
+    if name_parts[0] != "go_default_library":
+      dst.append(name_parts[0])
+    mappings[src] = "/".join(dst)
+  return mappings
+
+
+def _build_base_namespace(run, builder):
+  pass
+
+
+def _build_importmappings(run, builder):
+  """Override behavior to add plugin options before building the --go_out option"""
+  ctx = run.ctx
+  go_prefix = run.data.prefix or run.lang.prefix
+  opts = []
+
+  # Build the list of import mappings.  Start with any configured on
+  # the rule by attributes.
+  mappings = run.lang.importmap + run.data.importmap
+  mappings += _get_mappings(run.data.protos, run.data.label, go_prefix)
+
+  # Then add in the transitive set from dependent rules.
+  for unit in run.data.transitive_units:
+    mappings += unit.transitive_mappings
+
+  if run.data.verbose > 1:
+    print("go_importmap: %s" % mappings)
+
+  for k, v in mappings.items():
+    opts += ["M%s=%s" % (k, v)]
+
+  builder["transitive_mappings"] = mappings
+
+
+def _build_plugin_out(name, outdir, options, builder):
+  """Build the --{lang}_out argument for a given plugin."""
+  arg = outdir
+  if options:
+    arg = ",".join(options) + ":" + arg
+  builder["args"] += ["--%s_out=%s" % (name, arg)]
+
+
+def _build_protobuf_out(run, builder):
+  """Build the --{lang}_out option"""
+  lang = run.lang
+  name = lang.pb_plugin_name or lang.name
+  outdir = builder.get(lang.name + "_outdir", run.outdir)
+  options = builder.get(lang.name + "_pb_options", [])
+
+  _build_plugin_out(name, outdir, options, builder)
+
+
+def _get_outdir(ctx, lang, execdir):
+  if ctx.attr.output_to_workspace:
+    outdir = "."
+  else:
+    outdir = ctx.var["GENDIR"]
+  path = _get_offset_path(execdir, outdir)
+  if execdir != ".":
+    path += "/" + execdir
+  return path
+
+
+def _get_external_root(ctx):
+
+  # Compte set of "external workspace roots" that the proto
+  # sourcefiles belong to.
+  external_roots = []
+  for file in ctx.files.protos:
+    path = file.path.split('/')
+    if path[0] == 'external':
+      external_roots += ["/".join(path[0:2])]
+
+  # This set size must be 0 or 1. (all source files must exist in this
+  # workspace or the same external workspace).
+  roots = set(external_roots)
+  n = len(roots)
+  if n:
+    if n > 1:
+      fail(
+        """
+        You are attempting simultaneous compilation of protobuf source files that span multiple workspaces (%s).
+        Decompose your library rules into smaller units having filesets that belong to only a single workspace at a time.
+        Note that it is OK to *import* across multiple workspaces, but not compile them as file inputs to protoc.
+        """ % roots
+      )
+    else:
+      return external_roots[0]
+  else:
+    return "."
+
+
+def _compile(ctx, unit):
+
+  execdir = unit.data.execdir
+
+  protoc = _get_offset_path(execdir, unit.compiler.path)
+  imports = ["--proto_path=" + i for i in unit.imports]
+  srcs = [_get_offset_path(execdir, p.path) for p in unit.data.protos]
+  protoc_cmd = [protoc] + list(unit.args) + imports + srcs
+  manifest = [f.short_path for f in unit.outputs]
+
+  transitive_units = set()
+  for u in unit.data.transitive_units:
+    transitive_units = transitive_units | u.inputs
+  inputs = list(unit.inputs | transitive_units) + [unit.compiler]
+  outputs = list(unit.outputs)
+
+  cmds = [" ".join(protoc_cmd)]
+  if execdir != ".":
+    cmds.insert(0, "cd %s" % execdir)
+
+  if unit.data.output_to_workspace:
+    print(
+"""
+>**************************************************************************
+* - Generating files into the workspace...  This is potentially           *
+*   dangerous (may overwrite existing files) and violates bazel's         *
+*   sandbox policy.                                                       *
+* - Disregard "ERROR: output 'foo.pb.*' was not created." messages.       *
+* - Build will halt following the "not all outputs were created" message. *
+* - Output manifest is printed below.                                     *
+**************************************************************************<
+%s
+>*************************************************************************<
+""" % "\n".join(manifest)
+    )
+
+  if unit.data.verbose:
+    print(
+"""
+************************************************************
+cd $(bazel info execution_root)%s && \
+%s
+************************************************************
+%s
+************************************************************
+""" % (
+  "" if execdir == "." else "/" + execdir,
+  " \\ \n".join(protoc_cmd),
+  "\n".join(manifest))
+    )
+
+  if unit.data.verbose > 2:
+    for i in range(len(protoc_cmd)):
+      print(" > cmd%s: %s" % (i, protoc_cmd[i]))
+    for i in range(len(inputs)):
+      print(" > input%s: %s" % (i, inputs[i]))
+    for i in range(len(outputs)):
+      print(" > output%s: %s" % (i, outputs[i]))
+
+  ctx.action(
+    mnemonic = "ProtoCompile",
+    command = " && ".join(cmds),
+    inputs = inputs,
+    outputs = outputs,
+  )
+
+
+def _proto_compile_impl(ctx):
+
+  if ctx.attr.verbose > 1:
+    print("proto_compile %s:%s"  % (ctx.build_file_path, ctx.label.name))
+
+  # Calculate list of external roots and return the base directory
+  # we'll use for the protoc invocation.  Usually this is '.', but if
+  # not, its 'external/WORKSPACE'
+  execdir = _get_external_root(ctx)
+
+  # Propogate proto deps compilation units.
+  transitive_units = []
+  for dep in ctx.attr.deps:
+    for unit in dep.proto_compile_result.transitive_units:
+        transitive_units.append(unit)
+
+  if ctx.attr.prefix:
+    prefix = ctx.attr.prefix.go_prefix
+  else:
+    prefix = ""
+
+  # Immutable global state for this compiler run.
+  data = struct(
+    label = ctx.label,
+    workspace_name = ctx.workspace_name,
+    prefix = prefix,
+    execdir = execdir,
+    protos = ctx.files.protos,
+    descriptor_set = ctx.outputs.descriptor_set,
+    importmap = ctx.attr.importmap,
+    pb_options = ctx.attr.pb_options,
+    verbose = ctx.attr.verbose,
+    transitive_units = transitive_units,
+    output_to_workspace = ctx.attr.output_to_workspace,
+  )
+
+  #print("transitive_units: %s" % transitive_units)
+
+  # Mutable global state to be populated by the classes.
+  builder = {
+    "args": [], # list of string
+    "imports": ctx.attr.imports + ["."],
+    "inputs": ctx.files.protos + ctx.files.inputs,
+    "outputs": [],
+  }
+
+  # Build a list of structs that will be processed in this compiler
+  # run.
+  runs = []
+  for l in ctx.attr.langs:
+    lang = l.proto_language
+
+    exts = []
+    if lang.supports_pb:
+      exts += lang.pb_file_extensions
+
+    runs.append(struct(
+      ctx = ctx,
+      outdir = _get_outdir(ctx, lang, execdir),
+      lang = lang,
+      data = data,
+      exts = exts,
+      output_to_jar = lang.output_to_jar,
+    ))
+
+    builder["inputs"] += lang.pb_inputs
+    builder["imports"] += lang.pb_imports
+    builder[lang.name + "_pb_options"] = lang.pb_options + data.pb_options
+
+  _build_descriptor_set(data, builder)
+
+  for run in runs:
+    if run.lang.output_to_jar:
+      _build_output_jar(run, builder)
+    elif run.lang.output_to_library:
+      _build_output_library(run, builder)
+    elif run.lang.output_to_libdir:
+      _build_output_libdir(run, builder)
+    else:
+      _build_output_files(run, builder)
+    if run.lang.prefix: # golang-specific
+      _build_importmappings(run, builder)
+    if run.lang.supports_pb:
+      _build_protobuf_invocation(run, builder)
+      _build_protobuf_out(run, builder)
+
+
+  # Build final immutable compilation unit for rule and transitive beyond
+  unit = struct(
+    compiler = ctx.executable.protoc,
+    data = data,
+    transitive_mappings = builder.get("transitive_mappings", {}),
+    args = set(builder["args"] + ctx.attr.args),
+    imports = set(builder["imports"]),
+    inputs = set(builder["inputs"]),
+    outputs = set(builder["outputs"] + [ctx.outputs.descriptor_set]),
+  )
+
+  # Run protoc
+  _compile(ctx, unit)
+
+  for run in runs:
+    if run.lang.output_to_jar:
+      _build_output_srcjar(run, builder)
+
+  files = set(builder["outputs"])
+
+  return struct(
+    files = files,
+    proto_compile_result = struct(
+      unit = unit,
+      transitive_units = transitive_units + [unit],
+    ),
+  )
+
+proto_compile = rule(
+  implementation = _proto_compile_impl,
+  attrs = {
+    "args": attr.string_list(),
+    "langs": attr.label_list(
+      providers = ["proto_language"],
+      allow_files = False,
+      mandatory = False,
+    ),
+    "protos": attr.label_list(
+      allow_files = FileType([".proto"]),
+    ),
+    "deps": attr.label_list(
+      providers = ["proto_compile_result"]
+    ),
+    "protoc": attr.label(
+      default = Label("@com_google_protobuf//:protoc"),
+      cfg = "host",
+      executable = True,
+    ),
+    "prefix": attr.label(
+      providers = ["go_prefix"],
+    ),
+    "root": attr.string(),
+    "imports": attr.string_list(),
+    "importmap": attr.string_dict(),
+    "inputs": attr.label_list(
+      allow_files = True,
+    ),
+    "pb_options": attr.string_list(),
+    "output_to_workspace": attr.bool(),
+    "verbose": attr.int(),
+  },
+  outputs = {
+    "descriptor_set": "%{name}.descriptor_set",
+  },
+  output_to_genfiles = True, # this needs to be set for cc-rules.
+)
diff --git a/third_party/rules_protobuf/protobuf/internal/proto_language.bzl b/third_party/rules_protobuf/protobuf/internal/proto_language.bzl
new file mode 100644
index 000000000..19b0cab1c
--- /dev/null
+++ b/third_party/rules_protobuf/protobuf/internal/proto_language.bzl
@@ -0,0 +1,91 @@
+def _proto_language_impl(ctx):
+    prefix = None
+    if hasattr(ctx.attr.prefix, "go_prefix"):
+        prefix = ctx.attr.prefix.go_prefix
+    return struct(
+        proto_language = struct(
+            name = ctx.label.name,
+            output_to_workspace = ctx.attr.output_to_workspace,
+            output_to_jar = ctx.attr.output_to_jar,
+            output_to_library = ctx.attr.output_to_library,
+            output_to_libdir = ctx.attr.output_to_libdir,
+            output_file_style = ctx.attr.output_file_style,
+            supports_pb = ctx.attr.supports_pb,
+            pb_file_extensions = ctx.attr.pb_file_extensions,
+            pb_options = ctx.attr.pb_options,
+            pb_imports = ctx.attr.pb_imports,
+            pb_inputs = ctx.files.pb_inputs,
+            pb_plugin_name = ctx.attr.pb_plugin_name,
+            pb_plugin = ctx.executable.pb_plugin,
+            pb_compile_deps = ctx.files.pb_compile_deps,
+            pb_runtime_deps = ctx.files.pb_runtime_deps,
+            prefix = prefix,
+            importmap = ctx.attr.importmap,
+        ),
+    )
+
+
+proto_language_attrs = {
+    "output_to_workspace": attr.bool(),
+    "output_to_jar": attr.bool(),
+    "output_to_library": attr.bool(),
+    "output_to_libdir": attr.bool(),
+    "output_file_style": attr.string(),
+
+    "supports_pb": attr.bool(default = True),
+    "pb_file_extensions": attr.string_list(),
+    "pb_options": attr.string_list(),
+    "pb_inputs": attr.label_list(),
+    "pb_imports": attr.string_list(),
+    "pb_plugin_name": attr.string(),
+    "pb_plugin": attr.label(
+        executable = True,
+        cfg = "host",
+    ),
+    "pb_compile_deps": attr.label_list(),
+    "pb_runtime_deps": attr.label_list(),
+    "prefix": attr.label(
+        providers = ["go_prefix"],
+    ),
+    "importmap": attr.string_dict(),
+}
+
+
+proto_language = rule(
+    implementation = _proto_language_impl,
+    attrs = proto_language_attrs,
+)
+
+def _proto_language_deps_impl(ctx):
+    files = []
+    exts = ctx.attr.file_extensions
+
+    for dep in ctx.attr.langs:
+        lang = dep.proto_language
+        if ctx.attr.compile_deps:
+            files += lang.pb_compile_deps
+        if ctx.attr.runtime_deps:
+            files += lang.pb_runtime_deps
+
+    deps = []
+    for file in files:
+        for ext in exts:
+            if file.path.endswith(ext):
+                deps.append(file)
+
+    return struct(
+        files = set(deps),
+    )
+
+proto_language_deps = rule(
+    implementation = _proto_language_deps_impl,
+    attrs = {
+        "langs": attr.label_list(
+            providers = ["proto_language"],
+            mandatory = True,
+        ),
+        "file_extensions": attr.string_list(mandatory = True),
+        "compile_deps": attr.bool(default = True),
+        "runtime_deps": attr.bool(default = False),
+    }
+)
diff --git a/third_party/rules_protobuf/protobuf/internal/proto_repositories.bzl b/third_party/rules_protobuf/protobuf/internal/proto_repositories.bzl
new file mode 100644
index 000000000..b5988681a
--- /dev/null
+++ b/third_party/rules_protobuf/protobuf/internal/proto_repositories.bzl
@@ -0,0 +1,16 @@
+load("//third_party/rules_protobuf/protobuf:internal/require.bzl", "require")
+
+def proto_repositories(excludes = [],
+                       lang_deps = {},
+                       lang_requires = [],
+                       protobuf_deps = {},
+                       protobuf_requires = [],
+                       overrides = {},
+                       verbose = 0):
+  return require(
+    keys = protobuf_requires + lang_requires,
+    deps = protobuf_deps + lang_deps,
+    excludes = excludes,
+    overrides = overrides,
+    verbose = verbose,
+  )
diff --git a/third_party/rules_protobuf/protobuf/internal/require.bzl b/third_party/rules_protobuf/protobuf/internal/require.bzl
new file mode 100644
index 000000000..428e79661
--- /dev/null
+++ b/third_party/rules_protobuf/protobuf/internal/require.bzl
@@ -0,0 +1,77 @@
+def _needs_install(name, dep, hkeys=["sha256", "sha1", "tag"], verbose=0):
+
+    # Does it already exist?
+    existing_rule = native.existing_rule(name)
+    if not existing_rule:
+        return True
+
+    # If it has already been defined and our dependency lists a
+    # hash, do these match? If a hash mismatch is encountered, has
+    # the user specifically granted permission to continue?
+    for hkey in hkeys:
+        expected = dep.get(hkey)
+        actual = existing_rule.get(hkey)
+        if expected:
+            if expected != actual:
+                msg = """
+An existing {0} rule '{1}' was already loaded with a {2} value of '{3}'.  Refusing to overwrite this with the requested value ('{4}').
+Either remove the pre-existing rule from your WORKSPACE or exclude it from loading by rules_protobuf.
+""".format(existing_rule["kind"], name, hkey, actual, expected)
+
+                fail(msg)
+            else:
+                if verbose > 1: print("Skip reload %s: %s = %s" % (name, hkey, actual))
+                return False
+
+    # No kheys for this rule - in this case no reload; first one loaded wins.
+    if verbose > 1: print("Skipping reload of existing target %s" % name)
+    return False
+
+
+def _install(deps, verbose):
+    """Install a list if dependencies for matching native rules.
+    Return:
+      list of deps that have no matching native rule.
+    """
+    todo = []
+
+    for d in deps:
+        name = d.get("name")
+        rule = d.pop("rule", None)
+        if not rule:
+            fail("Missing attribute 'rule': %s" % name)
+        if hasattr(native, rule):
+            rule = getattr(native, rule)
+            if verbose: print("Loading %s)" % name)
+            rule(**d)
+        else:
+            d["rule"] = rule
+            todo.append(d)
+
+    return todo
+
+
+def require(keys,
+            deps = {},
+            overrides = {},
+            excludes = [],
+            verbose = 0):
+
+    #
+    # Make a list of non-excluded required deps with merged data.
+    #
+    required = []
+
+    for key in keys:
+        dep = deps.get(key)
+        if not dep:
+            fail("Unknown workspace dependency: %s" % key)
+        d = dict(**dep) # copy the 'frozen' object.
+        if not key in excludes:
+            over = overrides.get(key)
+            data = d + over if over else d
+            if _needs_install(key, data, verbose=verbose):
+                data["name"] = key
+                required.append(data)
+
+    return _install(required, verbose)
diff --git a/third_party/rules_protobuf/protobuf/rules.bzl b/third_party/rules_protobuf/protobuf/rules.bzl
new file mode 100644
index 000000000..17325e352
--- /dev/null
+++ b/third_party/rules_protobuf/protobuf/rules.bzl
@@ -0,0 +1,3 @@
+load("//third_party/rules_protobuf/protobuf:internal/proto_compile.bzl", "proto_compile")
+load("//third_party/rules_protobuf/protobuf:internal/proto_language.bzl", "proto_language", "proto_language_deps")
+load("//third_party/rules_protobuf/protobuf:internal/proto_repositories.bzl", "proto_repositories")
diff --git a/third_party/rules_protobuf/tests/BUILD b/third_party/rules_protobuf/tests/BUILD
new file mode 100644
index 000000000..a33806d67
--- /dev/null
+++ b/third_party/rules_protobuf/tests/BUILD
@@ -0,0 +1,24 @@
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache 2.0
+
+load("//third_party/rules_protobuf/javalite:rules.bzl", "java_lite_proto_library")
+
+java_lite_proto_library(
+    name = "message_java_lite_proto",
+    protos = ["message.proto"],
+    verbose = 0,
+)
+
+java_test(
+    name = "javalite_test",
+    srcs = [
+        "src/test/java/JavaLiteTest.java",
+    ],
+    test_class = "JavaLiteTest",
+    deps = [
+        ":message_java_lite_proto",
+        "@com_google_protobuf_java//:protobuf_java",
+        "@junit_junit_4//jar",
+    ],
+)
diff --git a/third_party/rules_protobuf/tests/message.proto b/third_party/rules_protobuf/tests/message.proto
new file mode 100644
index 000000000..5e694554d
--- /dev/null
+++ b/third_party/rules_protobuf/tests/message.proto
@@ -0,0 +1,8 @@
+syntax = "proto3";
+
+option java_package = "tests";
+option java_outer_classname = "MessageProto";
+
+message Message {
+  bool bar = 1;
+}
diff --git a/third_party/rules_protobuf/tests/src/test/java/JavaLiteTest.java b/third_party/rules_protobuf/tests/src/test/java/JavaLiteTest.java
new file mode 100644
index 000000000..9631714e1
--- /dev/null
+++ b/third_party/rules_protobuf/tests/src/test/java/JavaLiteTest.java
@@ -0,0 +1,36 @@
+// Copyright 2017 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import com.google.protobuf.GeneratedMessageLite;
+import tests.MessageProto.Message;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/**
+ * Tests for Util.
+ */
+@RunWith(JUnit4.class)
+public class JavaLiteTest {
+  @Test
+  public void testLiteProto() throws Exception {
+    assertTrue(GeneratedMessageLite.class.isAssignableFrom(Message.class));
+  }
+}
diff --git a/tools/tinkey/BUILD b/tools/tinkey/BUILD
index 97723a00d..626cd44f5 100644
--- a/tools/tinkey/BUILD
+++ b/tools/tinkey/BUILD
@@ -30,6 +30,7 @@ java_library(
         "@com_google_http_client//jar",
         "@com_google_http_client_jackson2//jar",
         "@com_google_oauth_client//jar",
+        "@com_google_protobuf_java//:protobuf_java",
     ],
 )
 
@@ -66,6 +67,7 @@ java_library(
         "//java:subtle",
         "//java:test_util",
         "@com_fasterxml_jackson_core//jar",
+        "@com_google_protobuf_java//:protobuf_java",
         "@junit_junit_4//jar",
     ],
 )
-- 
GitLab