520 lines
18 KiB
XML
520 lines
18 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
<groupId>io.github.chains-project</groupId>
|
|
<artifactId>maven-lockfile</artifactId>
|
|
<version>5.18.7-SNAPSHOT</version>
|
|
<packaging>maven-plugin</packaging>
|
|
<name>maven-lockfile-plugin</name>
|
|
<description>This plugin is a state-of-the-art solution that can be used to validate the integrity
|
|
of a maven repository.
|
|
It does this by generating a lock file that contains the checksums of all the artifacts and plugins in the
|
|
repository.
|
|
The lock file can then be used to validate the integrity of the repository.
|
|
This guards the supply chain against malicious actors that might tamper with the artifacts in
|
|
the repository.</description>
|
|
<url>https://github.com/chains-project/maven-lockfile</url>
|
|
<inceptionYear>2023</inceptionYear>
|
|
<licenses>
|
|
<license>
|
|
<name>MIT</name>
|
|
<url>https://opensource.org/licenses/MIT</url>
|
|
<distribution>repo</distribution>
|
|
</license>
|
|
</licenses>
|
|
<developers>
|
|
<developer>
|
|
<id>MartinWitt</id>
|
|
<name>Martin Wittlinger</name>
|
|
</developer>
|
|
</developers>
|
|
<prerequisites>
|
|
<maven>3.2.5</maven>
|
|
</prerequisites>
|
|
<scm>
|
|
<connection>scm:git:https://github.com/chains-project/maven-lockfile</connection>
|
|
<developerConnection>scm:git:https://github.com/chains-project/maven-lockfile.git</developerConnection>
|
|
<tag>v${project.version}</tag>
|
|
<url>https://github.com/chains-project/maven-lockfile/tree/${project.scm.tag}</url>
|
|
</scm>
|
|
<properties>
|
|
<mavenVersion>3.9.11</mavenVersion>
|
|
<maven.compiler.release>11</maven.compiler.release>
|
|
<project.build.outputTimestamp>2026-10-15T22:53:04Z</project.build.outputTimestamp>
|
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
|
<sigstore.skip>true</sigstore.skip>
|
|
</properties>
|
|
<dependencyManagement>
|
|
<dependencies>
|
|
<!-- Force upgrade of vulnerable transitive plexus-utils (GHSA-6fmv-xxpf-w3cw / CVE-2025-67030).
|
|
maven-core pulls in 3.6.0 via maven-model; override to safe version 4.0.3. -->
|
|
<dependency>
|
|
<groupId>org.codehaus.plexus</groupId>
|
|
<artifactId>plexus-utils</artifactId>
|
|
<version>4.1.0</version>
|
|
</dependency>
|
|
</dependencies>
|
|
</dependencyManagement>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.apache.maven</groupId>
|
|
<artifactId>maven-plugin-api</artifactId>
|
|
<version>${mavenVersion}</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
<!-- plexus-utils 4.x extracted XML APIs into plexus-xml; needed for XmlPullParserException -->
|
|
<dependency>
|
|
<groupId>org.codehaus.plexus</groupId>
|
|
<artifactId>plexus-xml</artifactId>
|
|
<version>4.2.0</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven.plugin-tools</groupId>
|
|
<artifactId>maven-plugin-annotations</artifactId>
|
|
<version>3.16.0</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter-api</artifactId>
|
|
<version>6.1.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven</groupId>
|
|
<artifactId>maven-core</artifactId>
|
|
<version>${mavenVersion}</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.code.gson</groupId>
|
|
<artifactId>gson</artifactId>
|
|
<version>2.14.0</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven.resolver</groupId>
|
|
<artifactId>maven-resolver-api</artifactId>
|
|
<version>2.0.24</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven.plugin-testing</groupId>
|
|
<artifactId>maven-plugin-testing-harness</artifactId>
|
|
<version>4.0.0-beta-4</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven</groupId>
|
|
<artifactId>maven-compat</artifactId>
|
|
<version>3.9.6</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter-engine</artifactId>
|
|
<version>6.1.3</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<!-- Explicit dependency to fix GHSA-rqfh-9r24-8c9r (XXE vulnerability in versions < 3.27.7) -->
|
|
<dependency>
|
|
<groupId>org.assertj</groupId>
|
|
<artifactId>assertj-core</artifactId>
|
|
<version>3.27.7</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.logging.log4j</groupId>
|
|
<artifactId>log4j-core</artifactId>
|
|
<version>2.26.1</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.soebes.itf.jupiter.extension</groupId>
|
|
<artifactId>itf-jupiter-extension</artifactId>
|
|
<version>0.13.1</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.soebes.itf.jupiter.extension</groupId>
|
|
<artifactId>itf-assertj</artifactId>
|
|
<version>0.13.1</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.instancio</groupId>
|
|
<artifactId>instancio-junit</artifactId>
|
|
<version>5.6.0</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.guava</groupId>
|
|
<artifactId>guava</artifactId>
|
|
<version>33.5.0-jre</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven.shared</groupId>
|
|
<artifactId>maven-dependency-tree</artifactId>
|
|
<version>3.3.0</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven.shared</groupId>
|
|
<artifactId>maven-artifact-transfer</artifactId>
|
|
<version>0.13.1</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven</groupId>
|
|
<artifactId>maven-model</artifactId>
|
|
<version>${mavenVersion}</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.maven</groupId>
|
|
<artifactId>maven-artifact</artifactId>
|
|
<version>${mavenVersion}</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>commons-io</groupId>
|
|
<artifactId>commons-io</artifactId>
|
|
<version>2.22.0</version>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.cyclonedx</groupId>
|
|
<artifactId>cyclonedx-maven-plugin</artifactId>
|
|
<version>2.9.3</version>
|
|
<inherited>true</inherited>
|
|
<configuration>
|
|
<includeTestScope>true</includeTestScope>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<goals>
|
|
<goal>makeBom</goal>
|
|
</goals>
|
|
<phase>package</phase>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>dev.sigstore</groupId>
|
|
<artifactId>sigstore-maven-plugin</artifactId>
|
|
<version>2.0.0</version>
|
|
<configuration>
|
|
<skip>${sigstore.skip}</skip>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<id>sign</id>
|
|
<goals>
|
|
<goal>sign</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-artifact-plugin</artifactId>
|
|
<version>3.7.0</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>com.diffplug.spotless</groupId>
|
|
<artifactId>spotless-maven-plugin</artifactId>
|
|
<version>3.1.0</version>
|
|
<configuration>
|
|
<formats>
|
|
<format>
|
|
<includes>
|
|
<include>.gitignore</include>
|
|
</includes>
|
|
<trimTrailingWhitespace/>
|
|
<endWithNewline/>
|
|
<indent>
|
|
<tabs>false</tabs>
|
|
<spaces>true</spaces>
|
|
<spacesPerTab>4</spacesPerTab>
|
|
</indent>
|
|
</format>
|
|
</formats>
|
|
<java>
|
|
<palantirJavaFormat/>
|
|
</java>
|
|
<pom>
|
|
<includes>
|
|
<include>pom.xml</include>
|
|
</includes>
|
|
<sortPom/>
|
|
</pom>
|
|
</configuration>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-deploy-plugin</artifactId>
|
|
<version>3.2.0</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.codehaus.gmavenplus</groupId>
|
|
<artifactId>gmavenplus-plugin</artifactId>
|
|
<version>4.3.1</version>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.apache.groovy</groupId>
|
|
<artifactId>groovy</artifactId>
|
|
<version>5.0.3</version>
|
|
<scope>runtime</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
<executions>
|
|
<execution>
|
|
<goals>
|
|
<goal>execute</goal>
|
|
</goals>
|
|
<phase>generate-resources</phase>
|
|
<configuration>
|
|
<scripts>
|
|
<script>def
|
|
file = new File(".github/workflows/Lockfile.yml")
|
|
project.properties.action_content = file.getText()</script>
|
|
</scripts>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-resources-plugin</artifactId>
|
|
<version>3.5.0</version>
|
|
<!-- kept plugin-level: the release workflows call `mvn resources:copy-resources` directly
|
|
from the CLI to regenerate action.yml/.mvn/extensions.xml at a specific point in the
|
|
release job, not as part of every normal build. -->
|
|
<configuration>
|
|
<outputDirectory>${project.basedir}</outputDirectory>
|
|
<resources>
|
|
<resource>
|
|
<directory>./template/</directory>
|
|
<includes>
|
|
<include>action.yml</include>
|
|
</includes>
|
|
<filtering>true</filtering>
|
|
</resource>
|
|
<resource>
|
|
<directory>./template/</directory>
|
|
<includes>
|
|
<include>extensions.xml</include>
|
|
</includes>
|
|
<targetPath>.mvn</targetPath>
|
|
<filtering>true</filtering>
|
|
</resource>
|
|
</resources>
|
|
<encoding>UTF-8</encoding>
|
|
</configuration>
|
|
<executions>
|
|
<!-- Disabled: otherwise these run on every normal build too, not just the release
|
|
workflow's explicit `resources:copy-resources` call. -->
|
|
<execution>
|
|
<id>default-resources</id>
|
|
<phase>none</phase>
|
|
</execution>
|
|
<execution>
|
|
<id>default-testResources</id>
|
|
<phase>none</phase>
|
|
</execution>
|
|
<!-- copy-resources (unlike the resources goal) accepts an outputDirectory/resources
|
|
override, so src/main/resources still reaches target/classes -->
|
|
<execution>
|
|
<id>copy-main-resources</id>
|
|
<goals>
|
|
<goal>copy-resources</goal>
|
|
</goals>
|
|
<phase>process-resources</phase>
|
|
<configuration>
|
|
<outputDirectory>${project.build.outputDirectory}</outputDirectory>
|
|
<resources combine.self="override">
|
|
<resource>
|
|
<directory>${project.basedir}/src/main/resources</directory>
|
|
</resource>
|
|
</resources>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-compiler-plugin</artifactId>
|
|
<version>3.16.0</version>
|
|
<configuration/>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-enforcer-plugin</artifactId>
|
|
<version>3.6.3</version>
|
|
<executions>
|
|
<execution>
|
|
<id>enforce-plugin-versions</id>
|
|
<goals>
|
|
<goal>enforce</goal>
|
|
</goals>
|
|
<configuration>
|
|
<rules>
|
|
<requirePluginVersions>
|
|
<message>Best Practice is to always define plugin versions!</message>
|
|
<banLatest>true</banLatest>
|
|
<banRelease>true</banRelease>
|
|
<banSnapshots>true</banSnapshots>
|
|
<phases>clean,deploy,site</phases>
|
|
<additionalPlugins>
|
|
<additionalPlugin>org.apache.maven.plugins:maven-reactor-plugin</additionalPlugin>
|
|
</additionalPlugins>
|
|
<unCheckedPluginList>org.apache.maven.plugins:maven-enforcer-plugin,org.apache.maven.plugins:maven-idea-plugin,org.apache.maven.plugins:maven-reactor-plugin</unCheckedPluginList>
|
|
</requirePluginVersions>
|
|
</rules>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-site-plugin</artifactId>
|
|
<version>3.22.0</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-clean-plugin</artifactId>
|
|
<version>3.5.0</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-install-plugin</artifactId>
|
|
<version>3.2.0</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<version>3.6.0</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-jar-plugin</artifactId>
|
|
<version>3.5.1</version>
|
|
<executions>
|
|
<execution>
|
|
<id>test-jar</id>
|
|
<goals>
|
|
<goal>test-jar</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-plugin-plugin</artifactId>
|
|
<version>3.16.0</version>
|
|
<configuration>
|
|
<!-- see https://issues.apache.org/jira/browse/MNG-5346 -->
|
|
<goalPrefix>configurator</goalPrefix>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<id>mojo-descriptor</id>
|
|
<goals>
|
|
<goal>descriptor</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>com.soebes.itf.jupiter.extension</groupId>
|
|
<artifactId>itf-maven-plugin</artifactId>
|
|
<version>0.13.1</version>
|
|
<executions>
|
|
<execution>
|
|
<id>installing</id>
|
|
<goals>
|
|
<goal>install</goal>
|
|
<goal>resources-its</goal>
|
|
</goals>
|
|
<phase>pre-integration-test</phase>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<artifactId>maven-failsafe-plugin</artifactId>
|
|
<version>3.6.0</version>
|
|
<configuration>
|
|
<!--
|
|
! currently needed to run integration tests.
|
|
-->
|
|
<systemPropertyVariables>
|
|
<maven.version>${maven.version}</maven.version>
|
|
<maven.home>${maven.home}</maven.home>
|
|
</systemPropertyVariables>
|
|
<properties>
|
|
<configurationParameters>junit.jupiter.execution.parallel.enabled=true
|
|
junit.jupiter.execution.parallel.mode.default=concurrent
|
|
junit.jupiter.execution.parallel.mode.classes.default=same_thread
|
|
junit.jupiter.execution.parallel.config.strategy=fixed
|
|
junit.jupiter.execution.parallel.config.fixed.parallelism=6</configurationParameters>
|
|
</properties>
|
|
<rerunFailingTestsCount>2</rerunFailingTestsCount>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<goals>
|
|
<goal>integration-test</goal>
|
|
<goal>verify</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
<profiles>
|
|
<profile>
|
|
<id>publication</id>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-javadoc-plugin</artifactId>
|
|
<version>3.12.0</version>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-javadocs</id>
|
|
<goals>
|
|
<goal>jar</goal>
|
|
</goals>
|
|
<configuration>
|
|
<attach>true</attach>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-source-plugin</artifactId>
|
|
<version>3.4.0</version>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-sources</id>
|
|
<goals>
|
|
<goal>jar</goal>
|
|
</goals>
|
|
<configuration>
|
|
<attach>true</attach>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-deploy-plugin</artifactId>
|
|
<version>3.2.0</version>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
</profiles>
|
|
</project>
|