| Run | | | Workspace | | | Log | | | Issues | | | Fixes | | | Pre-reqs | | | Stats | | | XRef | | | Maven Repository Proxy Log | |
||
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ MIT License
~
~ Permission is hereby granted, free of charge, to any person obtaining a copy
~ of this software and associated documentation files (the "Software"), to deal
~ in the Software without restriction, including without limitation the rights
~ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
~ copies of the Software, and to permit persons to whom the Software is
~ furnished to do so, subject to the following conditions:
~
~ The above copyright notice and this permission notice shall be included in all
~ copies or substantial portions of the Software.
~
~ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
~ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
~ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
~ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
~ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
~ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
~ SOFTWARE.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.github.package-url</groupId>
<artifactId>packageurl-java</artifactId>
<version>2.0.0-SNAPSHOT</version>
<packaging>jar</packaging>
<name>Package URL</name>
<description>The official Java implementation of the PackageURL specification. PackageURL (purl) is a minimal
specification for describing a package via a "mostly universal" URL.</description>
<url>https://github.com/package-url/packageurl-java</url>
<inceptionYear>2017</inceptionYear>
<licenses>
<license>
<name>MIT</name>
<url>https://opensource.org/licenses/MIT</url>
<distribution>repo</distribution>
</license>
</licenses>
<developers>
<developer>
<name>Steve Springett</name>
<email>Steve.Springett@owasp.org</email>
<organization>OWASP</organization>
<organizationUrl>http://www.owasp.org/</organizationUrl>
<roles>
<role>Architect</role>
<role>Developer</role>
</roles>
</developer>
</developers>
<scm>
<connection>scm:git:git@github.com:package-url/packageurl-java.git</connection>
<developerConnection>scm:git:git@github.com:package-url/packageurl-java.git</developerConnection>
<tag>HEAD</tag>
<url>https://github.com/package-url/packageurl-java.git</url>
</scm>
<issueManagement>
<system>GitHub</system>
<url>https://github.com/package-url/packageurl-java/issues</url>
</issueManagement>
<ciManagement>
<system>travis-ci</system>
<url>https://travis-ci.com/package-url/packageurl-java</url>
</ciManagement>
<distributionManagement>
<repository>
<id>ossrh</id>
<url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
</repository>
<snapshotRepository>
<id>ossrh</id>
<url>https://oss.sonatype.org/content/repositories/snapshots</url>
</snapshotRepository>
</distributionManagement>
<properties>
<!-- Maven Build Properties -->
<maven.compiler.release>8</maven.compiler.release>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<maven.javadoc.failOnError>false</maven.javadoc.failOnError>
<!--
~ `project.build.outputTimestamp` is required to be present for reproducible builds
~
~ Its value fixes various timestamps present in the JAR and should be incremented at each release.
-->
<project.build.outputTimestamp>2025-03-15T10:12:28Z</project.build.outputTimestamp>
<!-- Build requirements -->
<!--
~ Minimum JDK version required to build the library:
~ Maven plugins MUST be compatible with this version.
-->
<min.jdk.version>17</min.jdk.version>
<!--
~ Upper bound for the JDK version in an official release:
~ Builds MUST use a JDK version between `min.jdk.version` (inclusive) and `max.jdk.version` (exclusive)
~ to be reproducible.
-->
<max.jdk.version>18</max.jdk.version>
<!-- Maven Plugin Versions -->
<bnd.maven.plugin.version>7.3.0</bnd.maven.plugin.version>
<builder.helper.maven.plugin.version>3.6.1</builder.helper.maven.plugin.version>
<cyclonedx-maven-plugin.version>2.9.1</cyclonedx-maven-plugin.version>
<exec.maven.plugin.version>3.6.2</exec.maven.plugin.version>
<maven.clean.plugin.version>3.5.0</maven.clean.plugin.version>
<maven.compiler.plugin.version>3.14.0</maven.compiler.plugin.version>
<maven.dependency.plugin.version>3.8.1</maven.dependency.plugin.version>
<maven.deploy.plugin.version>3.1.4</maven.deploy.plugin.version>
<maven.enforcer.plugin.version>3.5.0</maven.enforcer.plugin.version>
<maven.gpg.plugin.version>3.2.7</maven.gpg.plugin.version>
<maven.install.plugin.version>3.1.4</maven.install.plugin.version>
<maven.jar.plugin.version>3.4.2</maven.jar.plugin.version>
<maven.javadoc.plugin.version>3.11.2</maven.javadoc.plugin.version>
<maven.release.plugin.version>3.1.1</maven.release.plugin.version>
<maven.resources.plugin.version>3.3.1</maven.resources.plugin.version>
<maven.site.plugin.version>3.21.0</maven.site.plugin.version>
<maven.source.plugin.version>3.4.0</maven.source.plugin.version>
<maven.surefire.plugin.version>3.5.3</maven.surefire.plugin.version>
<versions-maven-plugin.version>2.18.0</versions-maven-plugin.version>
<!-- Maven build plugins for quality checks -->
<error.prone.core.version>2.38.0</error.prone.core.version>
<nullaway.version>0.13.8</nullaway.version>
<jacoco.maven.plugin.version>0.8.13</jacoco.maven.plugin.version>
<palantir.java.format.version>2.58.0</palantir.java.format.version>
<spotbugs.maven.plugin.version>4.10.3.0</spotbugs.maven.plugin.version>
<spotless.maven.plugin.version>3.9.0</spotless.maven.plugin.version>
<com.github.spotbugs.version>4.9.3</com.github.spotbugs.version>
<!-- Dependency versions -->
<jakarta.validation-api.version>3.1.1</jakarta.validation-api.version>
<jmh.version>1.37</jmh.version>
<json.version>20260719</json.version>
<junit-bom.version>5.13.3</junit-bom.version>
<maven-surefire-junit5-tree-reporter.version>1.4.0</maven-surefire-junit5-tree-reporter.version>
</properties>
<dependencyManagement>
<dependencies>
<!-- BOMs at the end, so they don't overwrite the dependencies above -->
<dependency>
<groupId>org.junit</groupId>
<artifactId>junit-bom</artifactId>
<version>${junit-bom.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>jakarta.validation</groupId>
<artifactId>jakarta.validation-api</artifactId>
<version>${jakarta.validation-api.version}</version>
<scope>provided</scope>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.osgi</groupId>
<artifactId>org.osgi.annotation.bundle</artifactId>
<version>2.0.0</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.jspecify</groupId>
<artifactId>jspecify</artifactId>
<version>1.0.0</version>
<scope>provided</scope>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.openjdk.jmh</groupId>
<artifactId>jmh-core</artifactId>
<version>${jmh.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.json</groupId>
<artifactId>json</artifactId>
<version>${json.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-params</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<pluginManagement>
<plugins>
<plugin>
<groupId>biz.aQute.bnd</groupId>
<artifactId>bnd-baseline-maven-plugin</artifactId>
<version>${bnd.maven.plugin.version}</version>
</plugin>
<plugin>
<groupId>biz.aQute.bnd</groupId>
<artifactId>bnd-maven-plugin</artifactId>
<version>${bnd.maven.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-clean-plugin</artifactId>
<version>${maven.clean.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>${maven.compiler.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-deploy-plugin</artifactId>
<version>${maven.deploy.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<version>${maven.enforcer.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-install-plugin</artifactId>
<version>${maven.install.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<version>${maven-gpg-plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>${maven.jar.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-release-plugin</artifactId>
<version>${maven.release.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-resources-plugin</artifactId>
<version>${maven.resources.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-site-plugin</artifactId>
<version>${maven.site.plugin.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>${maven.surefire.plugin.version}</version>
</plugin>
</plugins>
</pluginManagement>
<plugins>
<!--
~ Parses the version into components.
~
~ The parsed version is used to generate the `Specification-Version` manifest header.
-->
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>build-helper-maven-plugin</artifactId>
<version>${builder.helper.maven.plugin.version}</version>
<executions>
<execution>
<id>parse-version</id>
<goals>
<goal>parse-version</goal>
</goals>
<phase>validate</phase>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<executions>
<execution>
<id>enforce-build-environment</id>
<goals>
<goal>enforce</goal>
</goals>
<configuration>
<rules>
<requireJavaVersion>
<display>true</display>
<version>[${min.jdk.version},)</version>
<message>To build this library you need JDK ${min.jdk.version} or higher.</message>
</requireJavaVersion>
<requirePluginVersions />
</rules>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<release>${maven.compiler.release}</release>
<showDeprecation>true</showDeprecation>
<compilerArgs>
<arg>-Xlint:all</arg>
<!-- Error Prone plugin -->
<arg>-XDcompilePolicy=simple</arg>
<arg>--should-stop=ifError=FLOW</arg>
<arg>-Xplugin:ErrorProne
-XepExcludedPaths:.*/generated-test-sources/.*
-Xep:NullAway:ERROR
-XepOpt:NullAway:OnlyNullMarked=true
-XepOpt:NullAway:TreatGeneratedAsUnannotated=true</arg>
<!--
~ Due to a bug in IntelliJ IDEA, annotation processing MUST be enabled.
~ Failing to do so will cause IDEA to ignore the annotation processor path
~ and choke on the Error Prone compiler arguments.
~
~ On the other hand, we cannot pass an empty `annotationProcessors` list to Maven,
~ since the `-processor` compiler argument requires at least one processor class name.
~
~ If you add an annotation processor, please also add an `annotationProcessors` configuration
~ option.
-->
</compilerArgs>
<annotationProcessorPaths>
<path>
<groupId>com.google.errorprone</groupId>
<artifactId>error_prone_core</artifactId>
<version>${error.prone.core.version}</version>
</path>
<path>
<groupId>com.uber.nullaway</groupId>
<artifactId>nullaway</artifactId>
<version>${nullaway.version}</version>
</path>
</annotationProcessorPaths>
</configuration>
<executions>
<execution>
<id>default-testCompile</id>
<configuration>
<compilerArgs>
<arg>-Xlint:all</arg>
<arg>-XDcompilePolicy=simple</arg>
<arg>--should-stop=ifError=FLOW</arg>
<arg>-Xplugin:ErrorProne
-XepExcludedPaths:.*/generated-test-sources/.*
-XepOpt:NullAway:OnlyNullMarked=true
-Xep:NullAway:OFF</arg>
<arg>-proc:full</arg>
</compilerArgs>
<annotationProcessors>
<processor>org.openjdk.jmh.generators.BenchmarkProcessor</processor>
</annotationProcessors>
<annotationProcessorPaths combine.children="append">
<path>
<groupId>org.openjdk.jmh</groupId>
<artifactId>jmh-generator-annprocess</artifactId>
<version>${jmh.version}</version>
</path>
</annotationProcessorPaths>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>com.diffplug.spotless</groupId>
<artifactId>spotless-maven-plugin</artifactId>
<version>${spotless.maven.plugin.version}</version>
<configuration>
<java>
<licenseHeader>
<file>src/headers/java.txt</file>
</licenseHeader>
<palantirJavaFormat>
<version>${palantir.java.format.version}</version>
</palantirJavaFormat>
</java>
<pom>
<licenseHeader>
<file>src/headers/xml.txt</file>
<delimiter><project</delimiter>
</licenseHeader>
<sortPom>
<expandEmptyElements>false</expandEmptyElements>
<!-- Maven Release plugin uses this style -->
<spaceBeforeCloseEmptyElement>true</spaceBeforeCloseEmptyElement>
</sortPom>
</pom>
</configuration>
<executions>
<execution>
<id>check-formatting</id>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
<version>${spotbugs.maven.plugin.version}</version>
<dependencies>
<!-- overwrite dependency on spotbugs if you want to specify the version of spotbugs -->
<dependency>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs</artifactId>
<version>${com.github.spotbugs.version}</version>
</dependency>
</dependencies>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
<phase>package</phase>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>${versions-maven-plugin.version}</version>
<configuration>
<ignoredVersions>(?i).+[-.](alpha|beta|cr|dev|m|rc)([-.]?\d+)?</ignoredVersions>
</configuration>
</plugin>
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<version>${jacoco.maven.plugin.version}</version>
<executions>
<execution>
<id>setup</id>
<goals>
<goal>prepare-agent</goal>
</goals>
</execution>
<execution>
<id>report</id>
<goals>
<goal>report</goal>
</goals>
<phase>prepare-package</phase>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>${maven.source.plugin.version}</version>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar-no-fork</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>${maven.javadoc.plugin.version}</version>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!--
~ Generates:
~
~ - An OSGi manifest.
~ - A JPMS module descriptor.
~ - The JAR artifact, by replacing `maven-jar-plugin`.
~
~ The advantage of the `jar` goal over `bnd-process`
~ is that it does not leave `module-info.class` files in the output directory,
~ which tend to confuse IDEs and need to be removed before a recompilation.
~
~ If `ServiceLoader` services were to be added `bnd-process` must be used to generate the appropriate
~ `META-INF/services` files and equivalent OSGi and JPMS entries.
-->
<plugin>
<groupId>biz.aQute.bnd</groupId>
<artifactId>bnd-maven-plugin</artifactId>
Continuation...
<!-- Replaces the `default-jar` execution of the Maven Jar Plugin -->
<extensions>true</extensions>
<executions>
<execution>
<id>generate-jar-and-module-descriptors</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!--
~ Checks for binary compatibility with the previous revision.
~ If this goal fails, the version of packages in `package-info.java` files must be incremented.
~
~ - If the difference type is `MICRO`, follow BND suggestions.
~ - If the difference type is `MINOR`, bump the artifact version to the next minor version.
~ - If the difference type is `MAJOR`, revert the breaking changes or make a major release.
-->
<plugin>
<groupId>biz.aQute.bnd</groupId>
<artifactId>bnd-baseline-maven-plugin</artifactId>
<executions>
<execution>
<id>check-api-compatibility</id>
<goals>
<goal>baseline</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>${cyclonedx-maven-plugin.version}</version>
<configuration>
<projectType>library</projectType>
</configuration>
<executions>
<execution>
<goals>
<goal>makeBom</goal>
</goals>
<phase>package</phase>
</execution>
</executions>
</plugin>
</plugins>
</build>
<profiles>
<!--
~ Profile to run tests using JRE 8.
~
~ It activates if a toolchains configuration file is present.
~ See: https://maven.apache.org/guides/mini/guide-using-toolchains.html
-->
<profile>
<id>java8-tests</id>
<activation>
<file>
<exists>${user.home}/.m2/toolchains.xml</exists>
</file>
</activation>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<configuration>
<reportFormat>plain</reportFormat>
<consoleOutputReporter>
<disable>true</disable>
</consoleOutputReporter>
<statelessTestsetInfoReporter implementation="org.apache.maven.plugin.surefire.extensions.junit5.JUnit5StatelessTestsetInfoTreeReporter" />
</configuration>
<dependencies>
<dependency>
<groupId>me.fabriciorby</groupId>
<artifactId>maven-surefire-junit5-tree-reporter</artifactId>
<version>${maven-surefire-junit5-tree-reporter.version}</version>
</dependency>
</dependencies>
<executions>
<execution>
<id>default-test</id>
<configuration>
<jdkToolchain>
<version>[1.8,9)</version>
</jdkToolchain>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
<profile>
<id>release</id>
<activation>
<activeByDefault>false</activeByDefault>
</activation>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<executions>
<execution>
<id>enforce-build-environment</id>
<configuration>
<rules>
<requireJavaVersion>
<display>true</display>
<version>[${min.jdk.version},${max.jdk.version})</version>
<message>To release this library you need JDK ${min.jdk.version}.</message>
</requireJavaVersion>
</rules>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-gpg-plugin</artifactId>
<executions>
<execution>
<id>sign-artifacts</id>
<goals>
<goal>sign</goal>
</goals>
<phase>verify</phase>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
<profile>
<id>benchmark</id>
<properties>
<jmh.args>.*</jmh.args>
<skipTests>true</skipTests>
</properties>
<build>
<defaultGoal>test-compile
dependency:build-classpath@build-classpath
exec:exec@run-benchmark</defaultGoal>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<version>${maven.dependency.plugin.version}</version>
<executions>
<execution>
<id>build-classpath</id>
<goals>
<goal>build-classpath</goal>
</goals>
<configuration>
<includeScope>test</includeScope>
<outputProperty>test.classpath</outputProperty>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
<version>${exec.maven.plugin.version}</version>
<executions>
<execution>
<id>run-benchmark</id>
<goals>
<goal>exec</goal>
</goals>
<configuration>
<environmentVariables>
<CLASSPATH>target${file.separator}classes${path.separator}target${file.separator}test-classes${path.separator}${test.classpath}</CLASSPATH>
</environmentVariables>
<executable>${java.home}${file.separator}bin${file.separator}java</executable>
<commandlineArgs>org.openjdk.jmh.Main ${jmh.args}</commandlineArgs>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>
</project>
Apache Gump, Gump, Apache, the Apache oak leaf logo, and the Apache Gump project logos are trademarks of The Apache Software Foundation.
Last Updated: Sun, 23 Aug 2026 00:00:09 ().