feat(notary): Import Notary Service and enable Bazel

.github/workflows/bazel.yml

@@ -131,6 +131,15 @@ jobs:
           # jq validates every field before the row reaches matrix generation.
           while IFS= read -r manifest; do
             path="${manifest%/bazel-java-ci.json}"
+            for forbidden in \
+              MODULE.bazel MODULE.bazel.lock maven_install.json \
+              .bazelrc .bazelversion .bazel_downloader_config \
+              WORKSPACE WORKSPACE.bazel bazel-enablement bazel-migration; do
+              if [ -e "${path}/${forbidden}" ]; then
+                echo "::error file=${path}/${forbidden}::Java components use root Bazel state; remove imported standalone file"
+                exit 1
+              fi
+            done
             id="$(jq -er '.id | select(test("^[a-z0-9][a-z0-9-]*$"))' "$manifest")"
             tests_skip="$(jq -er '.tests_skip | if type == "boolean" then tostring else error("tests_skip must be boolean") end' "$manifest")"
             component_kind="$(jq -er '.component_kind | select(. == "java-framework" or . == "java-service")' "$manifest")"

BAZEL.md

@@ -14,6 +14,8 @@ Bazel currently builds, tests, and packages:
 - `src/libraries/java/nv-boot-parent` (Java framework libraries and tests)
 - `src/control-plane-services/cloud-tasks` (Java libraries, tests, and Spring
   Boot application)
+- `src/control-plane-services/notary` (Java libraries, tests, and Spring Boot
+  application)
 
 Other upstream-owned subtrees remain excluded until they are onboarded one at
 a time. `nv-boot-parent` and onboarded Java service directories are folded

BUILD.bazel

@@ -20,19 +20,23 @@ exports_files(
     visibility = ["//src/libraries/go/lib:__pkg__"],
 )
 
-# Root module identity + third-party lock + NOTICE index, consumed by the
-# Java subtrees' NOTICE generation/verification tooling now that their Maven
-# closure is owned by the single root module.
+package_group(
+    name = "java_notice_consumers",
+    packages = [
+        "//src/control-plane-services/...",
+        "//src/libraries/java/...",
+    ],
+)
+
+# Root module identity, third-party lock, and NOTICE index consumed by Java
+# NOTICE generation and verification under the stable Java component paths.
 exports_files(
     [
         "MODULE.bazel",
         "NOTICE",
         "maven_install.json",
     ],
-    visibility = [
-        "//src/control-plane-services/cloud-tasks:__subpackages__",
-        "//src/libraries/java/nv-boot-parent:__subpackages__",
-    ],
+    visibility = [":java_notice_consumers"],
 )
 
 # Gazelle manages only the native Go subtrees listed in go.work.bazel.

MODULE.bazel

@@ -264,6 +264,8 @@ maven.install(
         "com.github.ben-manes.caffeine:guava",
         "com.github.java-json-tools:json-patch:1.13",
         "commons-codec:commons-codec",
+        # nv-boot-parent overrides the Spring Boot BOM's lower version.
+        "commons-logging:commons-logging:1.4.0",
         "io.cloudevents:cloudevents-core:4.1.1",
         "io.cloudevents:cloudevents-json-jackson:4.1.1",
         "io.micrometer:micrometer-tracing-bridge-otel",
@@ -272,6 +274,7 @@ maven.install(
         "io.opentelemetry:opentelemetry-sdk-testing",
         "jakarta.servlet:jakarta.servlet-api",
         "org.apache.cassandra:java-driver-metrics-micrometer",
+        "org.apache.commons:commons-collections4:4.5.0",
         "org.apache.commons:commons-lang3:3.20.0",
         "org.bouncycastle:bcprov-jdk18on:1.84",
         "org.jacoco:org.jacoco.agent:jar:runtime:0.8.14",
@@ -284,6 +287,8 @@ maven.install(
         "org.springdoc:springdoc-openapi-starter-webmvc-api:3.0.3",
         "org.springframework.boot:spring-boot-micrometer-tracing-opentelemetry",
         "org.springframework.boot:spring-boot-restclient",
+        # Spring Boot's Maven repackage goal injects this into executable jars.
+        "org.springframework.boot:spring-boot-jarmode-tools",
         "org.springframework.boot:spring-boot-starter",
         "org.springframework.boot:spring-boot-starter-actuator",
         "org.springframework.boot:spring-boot-starter-actuator-test",
@@ -361,6 +366,10 @@ maven.install(
         "org.springframework.cloud:spring-cloud-dependencies:2025.1.2",
         "org.testcontainers:testcontainers-bom:2.0.5",
     ],
+    # Spring Framework 7 embeds the AOP Alliance API in spring-aop. Maven's
+    # executable jar therefore omits the legacy standalone jar; excluding it
+    # here avoids duplicate org.aopalliance classes in Bazel applications.
+    excluded_artifacts = ["aopalliance:aopalliance"],
     fail_on_missing_checksum = True,
     fetch_sources = True,
     known_contributing_modules = [

NOTICE

@@ -307,6 +307,7 @@ The following third-party licenses are included in this repository:
     src/compute-plane-services/nvca/vendor/sigs.k8s.io/yaml/LICENSE
     src/compute-plane-services/nvsnap/NOTICE
     src/control-plane-services/cloud-tasks/NOTICE
+    src/control-plane-services/notary/NOTICE
     src/invocation-plane-services/llm-api-gateway/NOTICE
     src/invocation-plane-services/ratelimiter/NOTICE
     src/libraries/go/lib/vendor/cloud.google.com/go/compute/metadata/LICENSE