Revert "Upgrade Apache Commons Compress from 1.26.1 to 1.28.0" (bazelbuild#28469)

Reverts the upgrade of Apache Commons Compress.  1.28.0 back to 1.26.1 due to bazelbuild#28454 The comment in that issue suggests downgrading to 1.27.1 instead but I opted to just revert to 1.26.1 as that was the previous version it was at to reduce the likelihood of any additional regressions that may have occurred in 1.27.1.

I am not aware of any new functionality that relied on Apache Commons Compress being at 1.28.0.  The upgrade was done to clean up a test and provide accurate decompressed timestamps.

Fixes: bazelbuild#28454

Closes bazelbuild#28469.

PiperOrigin-RevId: 862634285
Change-Id: I4f6696fd28f358ed26b5bb179bee14ace9b58009

Author: willstranton

MODULE.bazel

@@ -219,7 +219,7 @@ maven.install(
         "javax.activation:javax.activation-api:1.2.0",
         "javax.annotation:javax.annotation-api:1.3.2",
         "javax.inject:javax.inject:1",
-        "org.apache.commons:commons-compress:1.28.0",
+        "org.apache.commons:commons-compress:1.26.1",
         "org.apache.commons:commons-lang3:3.14.0",
         "org.apache.tomcat:tomcat-annotations-api:8.0.5",
         "org.apache.velocity:velocity:1.7",

maven_install.json

@@ -1,7 +1,7 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": -1192428811,
-  "__RESOLVED_ARTIFACTS_HASH": -684605906,
+  "__INPUT_ARTIFACTS_HASH": -443743500,
+  "__RESOLVED_ARTIFACTS_HASH": -1216862662,
   "conflict_resolution": {
     "com.google.code.gson:gson:2.8.9": "com.google.code.gson:gson:2.11.0",
     "com.google.errorprone:error_prone_annotations:2.30.0": "com.google.errorprone:error_prone_annotations:2.46.0",
@@ -25,7 +25,6 @@
     "io.netty:netty-transport-native-unix-common:4.1.110.Final": "io.netty:netty-transport-native-unix-common:4.1.119.Final",
     "io.netty:netty-transport:4.1.110.Final": "io.netty:netty-transport:4.1.119.Final",
     "io.opencensus:opencensus-api:0.31.0": "io.opencensus:opencensus-api:0.31.1",
-    "org.apache.commons:commons-lang3:3.14.0": "org.apache.commons:commons-lang3:3.18.0",
     "org.checkerframework:checker-qual:3.12.0": "org.checkerframework:checker-qual:3.42.0"
   },
   "artifacts": {
@@ -379,9 +378,9 @@
     },
     "commons-codec:commons-codec": {
       "shasums": {
-        "jar": "5c3881e4f556855e9c532927ee0c9dfde94cc66760d5805c031a59887070af5f"
+        "jar": "ec87bfb55f22cbd1b21e2190eeda28b2b312ed2a431ee49fbdcc01812d04a5e4"
       },
-      "version": "1.19.0"
+      "version": "1.16.1"
     },
     "commons-collections:commons-collections": {
       "shasums": {
@@ -391,9 +390,9 @@
     },
     "commons-io:commons-io": {
       "shasums": {
-        "jar": "df90bba0fe3cb586b7f164e78fe8f8f4da3f2dd5c27fa645f888100ccc25dd72"
+        "jar": "a58af12ee1b68cfd2ebb0c27caef164f084381a00ec81a48cc275fd7ea54e154"
       },
-      "version": "2.20.0"
+      "version": "2.15.1"
     },
     "commons-lang:commons-lang": {
       "shasums": {
@@ -684,15 +683,15 @@
     },
     "org.apache.commons:commons-compress": {
       "shasums": {
-        "jar": "e1522945218456f3649a39bc4afd70ce4bd466221519dba7d378f2141a4642ca"
+        "jar": "27bb5d40f37c3bb7205b4a0540247df057715e9f6cbbd97d626ab8b50318bb04"
       },
-      "version": "1.28.0"
+      "version": "1.26.1"
     },
     "org.apache.commons:commons-lang3": {
       "shasums": {
-        "jar": "4eeeae8d20c078abb64b015ec158add383ac581571cddc45c68f0c9ae0230720"
+        "jar": "7b96bf3ee68949abb5bc465559ac270e0551596fa34523fddf890ec418dde13c"
       },
-      "version": "3.18.0"
+      "version": "3.14.0"
     },
     "org.apache.commons:commons-math3": {
       "shasums": {

src/test/java/com/google/devtools/build/lib/bazel/repository/decompressor/GzFunctionTest.java

@@ -15,7 +15,9 @@
 package com.google.devtools.build.lib.bazel.repository.decompressor;
 
 import static com.google.common.truth.Truth.assertThat;
+import static com.google.devtools.build.lib.testutil.TestConstants.PRODUCT_NAME;
 import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.junit.Assume.assumeFalse;
 
 import com.google.devtools.build.lib.testutil.TestUtils;
 import com.google.devtools.build.lib.vfs.FileSystem;
@@ -128,6 +130,9 @@ public static class FileAttributes {
 
     @Test
     public void setLastModifiedTime() throws IOException {
+      // TODO(pcloudy): Fix this test in Blaze.
+      assumeFalse(
+          "Skipping setLastModifiedTime test in Blaze environment.", PRODUCT_NAME.equals("blaze"));
       FileSystem testFs = TestArchiveDescriptor.getFileSystem();
       com.google.devtools.build.lib.vfs.Path tmpDir = TestUtils.createUniqueTmpDir(testFs);
       File testFile = new File(tmpDir.getPathFile(), "test_file");
@@ -150,8 +155,16 @@ public void setLastModifiedTime() throws IOException {
         fn.setFileAttributes(decompressorStream, testFs.getPath(testFile.getCanonicalPath()));
       }
 
+      // There was an error in Apache Commons Compress where the time was improperly divided by
+      // 1000, thus losing 3 digits of precision. This replicates that wrong behavior until we
+      // upgrade the Apache Commons Compress library to 1.28. At which point, you can replace
+      // hackExpectedTimeSeconds below with unixTimeSeconds.
+      // See https://github.com/apache/commons-compress/pull/624
+      // NOTE: 1.28 also has an issue - see https://github.com/bazelbuild/bazel/issues/28454
+      // so cleaning up this hack will need to wait until 1.29 is released.
+      long hackExpectedTimeSeconds = unixTimeSeconds / 1000 * 1000;
       // Time should be in epoch milliseconds.
-      assertThat(testFile.lastModified()).isEqualTo(unixTimeSeconds * 1000);
+      assertThat(testFile.lastModified()).isEqualTo(hackExpectedTimeSeconds * 1000);
     }
   }
 }