Skip to content

Commit a252d00

Browse files
davewichersdavewichers
committed
Add gpg signing plugin so: mvn install generates signature files.
Changed so Dependency Check and SpotBugs run when using 'site'. Added exclusions so project gets 100% convergence for all dependencies. Reordered dependencies in various places so they are imported in alphabetical order by GroupId and ArtifactID.
1 parent 95b13c9 commit a252d00

File tree

1 file changed

+123
-58
lines changed

1 file changed

+123
-58
lines changed

‎pom.xml‎

Lines changed: 123 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -137,9 +137,36 @@
137137

138138
<dependencies>
139139
<dependency>
140-
<groupId>commons-configuration</groupId>
141-
<artifactId>commons-configuration</artifactId>
142-
<version>1.10</version>
140+
<groupId>javax.servlet</groupId>
141+
<artifactId>javax.servlet-api</artifactId>
142+
<version>3.0.1</version>
143+
<scope>provided</scope>
144+
</dependency>
145+
<dependency>
146+
<groupId>javax.servlet.jsp</groupId>
147+
<artifactId>javax.servlet.jsp-api</artifactId>
148+
<version>2.3.3</version>
149+
<scope>provided</scope>
150+
</dependency>
151+
<dependency>
152+
<groupId>com.io7m.xom</groupId>
153+
<artifactId>xom</artifactId>
154+
<version>1.2.10</version>
155+
<exclusions>
156+
<!-- excluded because we directly import newer versions. -->
157+
<exclusion>
158+
<groupId>xalan</groupId>
159+
<artifactId>xalan</artifactId>
160+
</exclusion>
161+
<exclusion>
162+
<groupId>xerces</groupId>
163+
<artifactId>xercesImpl</artifactId>
164+
</exclusion>
165+
<exclusion>
166+
<groupId>xml-apis</groupId>
167+
<artifactId>xml-apis</artifactId>
168+
</exclusion>
169+
</exclusions>
143170
</dependency>
144171
<dependency>
145172
<groupId>commons-beanutils</groupId>
@@ -153,58 +180,40 @@
153180
-->
154181
</dependency>
155182
<dependency>
156-
<groupId>javax.servlet</groupId>
157-
<artifactId>javax.servlet-api</artifactId>
158-
<version>3.0.1</version>
159-
<scope>provided</scope>
160-
</dependency>
161-
<dependency>
162-
<groupId>javax.servlet.jsp</groupId>
163-
<artifactId>javax.servlet.jsp-api</artifactId>
164-
<version>2.3.3</version>
165-
<scope>provided</scope>
183+
<groupId>commons-configuration</groupId>
184+
<artifactId>commons-configuration</artifactId>
185+
<version>1.10</version>
186+
<exclusions>
187+
<!-- excluded because multiple dependencies import newer version. -->
188+
<exclusion>
189+
<groupId>commons-logging</groupId>
190+
<artifactId>commons-logging</artifactId>
191+
</exclusion>
192+
</exclusions>
166193
</dependency>
167194
<dependency>
168195
<groupId>commons-fileupload</groupId>
169196
<artifactId>commons-fileupload</artifactId>
197+
<!-- Upgrading to 1.4 causes this test case failure: [ERROR] HTTPUtilitiesTest.testGetFileUploads:259. TODO: Figure out why, and fix. -->
170198
<version>1.3.3</version>
171-
<!-- exclusions>
199+
<exclusions>
200+
<!-- excluded because we directly import newer version. -->
172201
<exclusion>
173202
<groupId>commons-io</groupId>
174203
<artifactId>commons-io</artifactId>
175204
</exclusion>
176-
</exclusions -->
177-
</dependency>
178-
<dependency>
179-
<groupId>org.apache.commons</groupId>
180-
<artifactId>commons-collections4</artifactId>
181-
<!-- Using 4.2 because 4.3 requires Java 8. Trying to make sure ESAPI supports Java 7+ -->
182-
<version>4.2</version>
205+
</exclusions>
183206
</dependency>
184207
<dependency>
185208
<groupId>log4j</groupId>
186209
<artifactId>log4j</artifactId>
187210
<version>1.2.17</version>
188211
</dependency>
189212
<dependency>
190-
<groupId>org.slf4j</groupId>
191-
<artifactId>slf4j-api</artifactId>
192-
<version>1.7.26</version>
193-
</dependency>
194-
<dependency>
195-
<groupId>com.io7m.xom</groupId>
196-
<artifactId>xom</artifactId>
197-
<version>1.2.10</version>
198-
<exclusions>
199-
<exclusion>
200-
<groupId>xerces</groupId>
201-
<artifactId>xercesImpl</artifactId>
202-
</exclusion>
203-
<exclusion>
204-
<groupId>xml-apis</groupId>
205-
<artifactId>xml-apis</artifactId>
206-
</exclusion>
207-
</exclusions>
213+
<groupId>org.apache.commons</groupId>
214+
<artifactId>commons-collections4</artifactId>
215+
<!-- Using 4.2 because 4.3 requires Java 8. Trying to make sure ESAPI supports Java 7+ -->
216+
<version>4.2</version>
208217
</dependency>
209218
<dependency>
210219
<groupId>org.apache-extras.beanshell</groupId>
@@ -226,20 +235,20 @@
226235
</exclusion>
227236
</exclusions>
228237
</dependency>
238+
<dependency>
239+
<groupId>org.slf4j</groupId>
240+
<artifactId>slf4j-api</artifactId>
241+
<version>1.7.26</version>
242+
</dependency>
229243

230244
<!--
231245
FORCE SPECIFIC VERSIONS OF TRANSITIVE DEPENDENCIES EXCLUDED ABOVE.
232246
This is to force patched versions of these libraries with known CVEs against them.
233247
-->
234248
<dependency>
235-
<groupId>xalan</groupId>
236-
<artifactId>xalan</artifactId>
237-
<version>2.7.2</version>
238-
</dependency>
239-
<dependency>
240-
<groupId>xml-apis</groupId>
241-
<artifactId>xml-apis</artifactId>
242-
<version>1.4.01</version>
249+
<groupId>commons-io</groupId>
250+
<artifactId>commons-io</artifactId>
251+
<version>2.6</version>
243252
</dependency>
244253
<dependency>
245254
<groupId>org.apache.xmlgraphics</groupId>
@@ -256,15 +265,26 @@
256265
</exclusion>
257266
</exclusions>
258267
</dependency>
268+
<dependency>
269+
<groupId>xalan</groupId>
270+
<artifactId>xalan</artifactId>
271+
<version>2.7.2</version>
272+
<exclusions>
273+
<exclusion>
274+
<groupId>xml-apis</groupId>
275+
<artifactId>xml-apis</artifactId>
276+
</exclusion>
277+
</exclusions>
278+
</dependency>
259279
<dependency>
260280
<groupId>xerces</groupId>
261281
<artifactId>xercesImpl</artifactId>
262282
<version>2.12.0</version>
263283
</dependency>
264284
<dependency>
265-
<groupId>commons-io</groupId>
266-
<artifactId>commons-io</artifactId>
267-
<version>2.6</version>
285+
<groupId>xml-apis</groupId>
286+
<artifactId>xml-apis</artifactId>
287+
<version>1.4.01</version>
268288
</dependency>
269289

270290
<!-- Dependencies which are ONLY used for JUnit tests -->
@@ -286,6 +306,35 @@
286306
<artifactId>powermock-api-mockito2</artifactId>
287307
<version>2.0.0</version>
288308
<scope>test</scope>
309+
<!-- These exclusions required to avoid convergence issues with import of mockito-core -->
310+
<exclusions>
311+
<exclusion>
312+
<groupId>org.mockito</groupId>
313+
<artifactId>mockito-core</artifactId>
314+
</exclusion>
315+
<exclusion>
316+
<groupId>net.bytebuddy</groupId>
317+
<artifactId>byte-buddy</artifactId>
318+
</exclusion>
319+
<exclusion>
320+
<groupId>net.bytebuddy</groupId>
321+
<artifactId>byte-buddy-agent</artifactId>
322+
</exclusion>
323+
</exclusions>
324+
</dependency>
325+
<!-- The following imported solely so we can exclude its dependency on: org.objenesis:objenesis, which conflicts with
326+
another import by a dependency of powermock-api-mockito2. -->
327+
<dependency>
328+
<groupId>org.mockito</groupId>
329+
<artifactId>mockito-core</artifactId>
330+
<version>2.27.0</version>
331+
<scope>test</scope>
332+
<exclusions>
333+
<exclusion>
334+
<groupId>org.objenesis</groupId>
335+
<artifactId>objenesis</artifactId>
336+
</exclusion>
337+
</exclusions>
289338
</dependency>
290339
<dependency>
291340
<groupId>org.powermock</groupId>
@@ -343,6 +392,7 @@
343392
</plugin>
344393

345394
<plugin>
395+
<groupId>org.apache.maven.plugins</groupId>
346396
<artifactId>maven-compiler-plugin</artifactId>
347397
<version>3.8.0</version>
348398
<configuration>
@@ -395,6 +445,25 @@
395445
<artifactId>maven-enforcer-plugin</artifactId>
396446
<version>1.4.1</version>
397447
</plugin>
448+
449+
<plugin>
450+
<groupId>org.apache.maven.plugins</groupId>
451+
<artifactId>maven-gpg-plugin</artifactId>
452+
<version>1.6</version>
453+
<executions>
454+
<execution>
455+
<id>sign-artifacts</id>
456+
<phase>verify</phase>
457+
<goals> <goal>sign</goal> </goals>
458+
</execution>
459+
</executions>
460+
</plugin>
461+
462+
<plugin>
463+
<groupId>org.apache.maven.plugins</groupId>
464+
<artifactId>maven-install-plugin</artifactId>
465+
<version>2.5.2</version>
466+
</plugin>
398467

399468
<plugin>
400469
<groupId>org.apache.maven.plugins</groupId>
@@ -410,12 +479,6 @@
410479
</configuration>
411480
</plugin>
412481

413-
<plugin>
414-
<groupId>org.apache.maven.plugins</groupId>
415-
<artifactId>maven-install-plugin</artifactId>
416-
<version>2.5.2</version>
417-
</plugin>
418-
419482
<plugin>
420483
<groupId>org.apache.maven.plugins</groupId>
421484
<artifactId>maven-javadoc-plugin</artifactId>
@@ -493,7 +556,7 @@
493556
<artifactId>dependency-check-maven</artifactId>
494557
<version>5.0.0-M2</version>
495558
<configuration>
496-
<!-- <failBuildOnCVSS>5.9</failBuildOnCVSS> -->
559+
<failBuildOnCVSS>5.9</failBuildOnCVSS>
497560
<suppressionFile>./suppressions.xml</suppressionFile>
498561
</configuration>
499562
<executions>
@@ -533,6 +596,7 @@
533596
</configuration>
534597
</plugin>
535598
<plugin>
599+
<groupId>org.apache.maven.plugins</groupId>
536600
<artifactId>maven-javadoc-plugin</artifactId>
537601
<configuration>
538602
<detectJavaApiLink>false</detectJavaApiLink>
@@ -550,6 +614,7 @@
550614
</configuration>
551615
</plugin>
552616
<plugin>
617+
<groupId>org.apache.maven.plugins</groupId>
553618
<artifactId>maven-site-plugin</artifactId>
554619
<configuration>
555620
<reportPlugins>
@@ -615,7 +680,7 @@
615680
<jdk>[1.8,)</jdk>
616681
</activation>
617682
<properties>
618-
<PhaseIfJava8plus>install</PhaseIfJava8plus>
683+
<PhaseIfJava8plus>site</PhaseIfJava8plus>
619684
</properties>
620685
</profile>
621686

0 commit comments

Comments
 (0)