pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ MIT License
  ~
  ~ Permission is hereby granted, free of charge, to any person obtaining a copy
  ~ of this software and associated documentation files (the "Software"), to deal
  ~ in the Software without restriction, including without limitation the rights
  ~ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  ~ copies of the Software, and to permit persons to whom the Software is
  ~ furnished to do so, subject to the following conditions:
  ~
  ~ The above copyright notice and this permission notice shall be included in all
  ~ copies or substantial portions of the Software.
  ~
  ~ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  ~ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  ~ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  ~ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  ~ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  ~ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  ~ SOFTWARE.
  -->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.github.package-url</groupId>
  <artifactId>packageurl-java</artifactId>
  <version>1.6.0-SNAPSHOT</version>
  <packaging>jar</packaging>

  <name>Package URL</name>
  <description>The official Java implementation of the PackageURL specification. PackageURL (purl) is a minimal
        specification for describing a package via a "mostly universal" URL.</description>
  <url>https://github.com/package-url/packageurl-java</url>
  <inceptionYear>2017</inceptionYear>

  <licenses>
    <license>
      <name>MIT</name>
      <url>https://opensource.org/licenses/MIT</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <name>Steve Springett</name>
      <email>Steve.Springett@owasp.org</email>
      <organization>OWASP</organization>
      <organizationUrl>http://www.owasp.org/</organizationUrl>
      <roles>
        <role>Architect</role>
        <role>Developer</role>
      </roles>
    </developer>
  </developers>

  <scm>
    <connection>scm:git:git@github.com:package-url/packageurl-java.git</connection>
    <developerConnection>scm:git:git@github.com:package-url/packageurl-java.git</developerConnection>
    <tag>HEAD</tag>
    <url>https://github.com/package-url/packageurl-java.git</url>
  </scm>

  <issueManagement>
    <system>GitHub</system>
    <url>https://github.com/package-url/packageurl-java/issues</url>
  </issueManagement>

  <ciManagement>
    <system>travis-ci</system>
    <url>https://travis-ci.com/package-url/packageurl-java</url>
  </ciManagement>

  <distributionManagement>
    <repository>
      <id>ossrh</id>
      <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
    </repository>
    <snapshotRepository>
      <id>ossrh</id>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
    </snapshotRepository>
  </distributionManagement>

  <properties>
    <!-- Maven Build Properties -->
    <maven.compiler.release>8</maven.compiler.release>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <maven.javadoc.failOnError>false</maven.javadoc.failOnError>

    <!--
          ~ `project.build.outputTimestamp` is required to be present for reproducible builds
          ~
          ~ Its value fixes various timestamps present in the JAR and should be incremented at each release.
          -->
    <project.build.outputTimestamp>2025-03-15T10:12:28Z</project.build.outputTimestamp>

    <!-- Build requirements -->
    <!--
          ~ Minimum JDK version required to build the library:
          ~ Maven plugins MUST be compatible with this version.
          -->
    <min.jdk.version>17</min.jdk.version>
    <!--
          ~ Upper bound for the JDK version in an official release:
          ~ Builds MUST use a JDK version between `min.jdk.version` (inclusive) and `max.jdk.version` (exclusive)
          ~ to be reproducible.
          -->
    <max.jdk.version>18</max.jdk.version>

    <!-- Maven Plugin Versions -->
    <bnd.maven.plugin.version>7.1.0</bnd.maven.plugin.version>
    <builder.helper.maven.plugin.version>3.6.0</builder.helper.maven.plugin.version>
    <cyclonedx-maven-plugin.version>2.9.1</cyclonedx-maven-plugin.version>
    <maven.clean.plugin.version>3.4.1</maven.clean.plugin.version>
    <maven.compiler.plugin.version>3.14.0</maven.compiler.plugin.version>
    <maven.deploy.plugin.version>3.1.4</maven.deploy.plugin.version>
    <maven.enforcer.plugin.version>3.5.0</maven.enforcer.plugin.version>
    <maven.gpg.plugin.version>3.2.7</maven.gpg.plugin.version>
    <maven.install.plugin.version>3.1.4</maven.install.plugin.version>
    <maven.jar.plugin.version>3.4.2</maven.jar.plugin.version>
    <maven.javadoc.plugin.version>3.11.2</maven.javadoc.plugin.version>
    <maven.release.plugin.version>3.1.1</maven.release.plugin.version>
    <maven.resources.plugin.version>3.3.1</maven.resources.plugin.version>
    <maven.site.plugin.version>3.21.0</maven.site.plugin.version>
    <maven.source.plugin.version>3.3.1</maven.source.plugin.version>
    <maven.surefire.plugin.version>3.5.2</maven.surefire.plugin.version>
    <versions-maven-plugin.version>2.18.0</versions-maven-plugin.version>
    <!-- Maven build plugins for quality checks -->
    <error.prone.core.version>2.37.0</error.prone.core.version>
    <jacoco.maven.plugin.version>0.8.12</jacoco.maven.plugin.version>
    <palantir.java.format.version>2.58.0</palantir.java.format.version>
    <spotbugs.maven.plugin.version>4.9.3.0</spotbugs.maven.plugin.version>
    <spotless.maven.plugin.version>2.44.3</spotless.maven.plugin.version>
    <com.github.spotbugs.version>4.9.3</com.github.spotbugs.version>
    <!-- Dependency versions -->
    <jakarta.validation-api.version>3.1.1</jakarta.validation-api.version>
    <json.version>20250107</json.version>
    <junit-bom.version>5.12.1</junit-bom.version>
    <maven-surefire-junit5-tree-reporter.version>1.4.0</maven-surefire-junit5-tree-reporter.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <!-- BOMs at the end, so they don't overwrite the dependencies above -->
      <dependency>
        <groupId>org.junit</groupId>
        <artifactId>junit-bom</artifactId>
        <version>${junit-bom.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <dependencies>
    <dependency>
      <groupId>jakarta.validation</groupId>
      <artifactId>jakarta.validation-api</artifactId>
      <version>${jakarta.validation-api.version}</version>
      <scope>provided</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.osgi</groupId>
      <artifactId>org.osgi.annotation.bundle</artifactId>
      <version>2.0.0</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>org.jspecify</groupId>
      <artifactId>jspecify</artifactId>
      <version>1.0.0</version>
      <scope>provided</scope>
      <optional>true</optional>
    </dependency>
    <dependency>
      <groupId>org.json</groupId>
      <artifactId>json</artifactId>
      <version>${json.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter-api</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter-params</artifactId>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>biz.aQute.bnd</groupId>
          <artifactId>bnd-baseline-maven-plugin</artifactId>
          <version>${bnd.maven.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>biz.aQute.bnd</groupId>
          <artifactId>bnd-maven-plugin</artifactId>
          <version>${bnd.maven.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-clean-plugin</artifactId>
          <version>${maven.clean.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>${maven.compiler.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>${maven.deploy.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-enforcer-plugin</artifactId>
          <version>${maven.enforcer.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-install-plugin</artifactId>
          <version>${maven.install.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-gpg-plugin</artifactId>
          <version>${maven-gpg-plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>${maven.jar.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-release-plugin</artifactId>
          <version>${maven.release.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-resources-plugin</artifactId>
          <version>${maven.resources.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-site-plugin</artifactId>
          <version>${maven.site.plugin.version}</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>${maven.surefire.plugin.version}</version>
        </plugin>
      </plugins>
    </pluginManagement>
    <plugins>
      <!--
              ~ Parses the version into components.
              ~
              ~ The parsed version is used to generate the `Specification-Version` manifest header.
              -->
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>build-helper-maven-plugin</artifactId>
        <version>${builder.helper.maven.plugin.version}</version>
        <executions>
          <execution>
            <id>parse-version</id>
            <goals>
              <goal>parse-version</goal>
            </goals>
            <phase>validate</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>enforce-build-environment</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <requireJavaVersion>
                  <display>true</display>
                  <version>[${min.jdk.version},)</version>
                  <message>To build this library you need JDK ${min.jdk.version} or higher.</message>
                </requireJavaVersion>
                <requirePluginVersions />
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <release>${maven.compiler.release}</release>
          <showDeprecation>true</showDeprecation>
          <compilerArgs>
            <arg>-Xlint:all</arg>
            <!-- Error Prone plugin -->
            <arg>-XDcompilePolicy=simple</arg>
            <arg>--should-stop=ifError=FLOW</arg>
            <arg>-Xplugin:ErrorProne</arg>
            <!--
                          ~ Due to a bug in IntelliJ IDEA, annotation processing MUST be enabled.
                          ~ Failing to do so will cause IDEA to ignore the annotation processor path
                          ~ and choke on the Error Prone compiler arguments.
                          ~
                          ~ On the other hand, we cannot pass an empty `annotationProcessors` list to Maven,
                          ~ since the `-processor` compiler argument requires at least one processor class name.
                          ~
                          ~ If you add an annotation processor, please also add an `annotationProcessors` configuration
                          ~ option.
                          -->
          </compilerArgs>
          <annotationProcessorPaths>
            <path>
              <groupId>com.google.errorprone</groupId>
              <artifactId>error_prone_core</artifactId>
              <version>${error.prone.core.version}</version>
            </path>
          </annotationProcessorPaths>
        </configuration>
      </plugin>
      <plugin>
        <groupId>com.diffplug.spotless</groupId>
        <artifactId>spotless-maven-plugin</artifactId>
        <version>${spotless.maven.plugin.version}</version>
        <configuration>
          <java>
            <licenseHeader>
              <file>src/headers/java.txt</file>
            </licenseHeader>
            <palantirJavaFormat>
              <version>${palantir.java.format.version}</version>
            </palantirJavaFormat>
          </java>
          <pom>
            <licenseHeader>
              <file>src/headers/xml.txt</file>
              <delimiter>&lt;project</delimiter>
            </licenseHeader>
            <sortPom>
              <expandEmptyElements>false</expandEmptyElements>
              <!-- Maven Release plugin uses this style -->
              <spaceBeforeCloseEmptyElement>true</spaceBeforeCloseEmptyElement>
            </sortPom>
          </pom>
        </configuration>
        <executions>
          <execution>
            <id>check-formatting</id>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>com.github.spotbugs</groupId>
        <artifactId>spotbugs-maven-plugin</artifactId>
        <version>${spotbugs.maven.plugin.version}</version>
        <dependencies>
          <!-- overwrite dependency on spotbugs if you want to specify the version of spotbugs -->
          <dependency>
            <groupId>com.github.spotbugs</groupId>
            <artifactId>spotbugs</artifactId>
            <version>${com.github.spotbugs.version}</version>
          </dependency>
        </dependencies>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
            <phase>package</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>versions-maven-plugin</artifactId>
        <version>${versions-maven-plugin.version}</version>
        <configuration>
          <ignoredVersions>(?i).+[-.](alpha|beta|cr|dev|m|rc)([-.]?\d+)?</ignoredVersions>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.jacoco</groupId>
        <artifactId>jacoco-maven-plugin</artifactId>
        <version>${jacoco.maven.plugin.version}</version>
        <executions>
          <execution>
            <id>setup</id>
            <goals>
              <goal>prepare-agent</goal>
            </goals>
          </execution>
          <execution>
            <id>report</id>
            <goals>
              <goal>report</goal>
            </goals>
            <phase>prepare-package</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <version>${maven.source.plugin.version}</version>
        <executions>
          <execution>
            <id>attach-sources</id>
            <goals>
              <goal>jar-no-fork</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <version>${maven.javadoc.plugin.version}</version>
        <executions>
          <execution>
            <id>attach-javadocs</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <!--
              ~ Generates:
              ~
              ~ - An OSGi manifest.
              ~ - A JPMS module descriptor.
              ~ - The JAR artifact, by replacing `maven-jar-plugin`.
              ~
              ~ The advantage of the `jar` goal over `bnd-process`
              ~ is that it does not leave `module-info.class` files in the output directory,
              ~ which tend to confuse IDEs and need to be removed before a recompilation.
              ~
              ~ If `ServiceLoader` services were to be added `bnd-process` must be used to generate the appropriate
              ~ `META-INF/services` files and equivalent OSGi and JPMS entries.
              -->
      <plugin>
        <groupId>biz.aQute.bnd</groupId>
        <artifactId>bnd-maven-plugin</artifactId>
        <!-- Replaces the `default-jar` execution of the Maven Jar Plugin -->
        <extensions>true</extensions>
        <executions>
          <execution>
            <id>generate-jar-and-module-descriptors</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <!--
              ~ Checks for binary compatibility with the previous revision.
              ~ If this goal fails, the version of packages in `package-info.java` files must be incremented.
              ~
              ~ - If the difference type is `MICRO`, follow BND suggestions.
              ~ - If the difference type is `MINOR`, bump the artifact version to the next minor version.
              ~ - If the difference type is `MAJOR`, revert the breaking changes or make a major release.
              -->
      <plugin>
        <groupId>biz.aQute.bnd</groupId>
        <artifactId>bnd-baseline-maven-plugin</artifactId>
        <executions>
          <execution>
            <id>check-api-compatibility</id>
            <goals>
              <goal>baseline</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <version>${cyclonedx-maven-plugin.version}</version>
        <configuration>
          <projectType>library</projectType>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>makeBom</goal>
            </goals>
            <phase>package</phase>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <!--
          ~ Profile to run tests using JRE 8.
          ~
          ~ It activates if a toolchains configuration file is present.
          ~ See: https://maven.apache.org/guides/mini/guide-using-toolchains.html
          -->
    <profile>
      <id>java8-tests</id>
      <activation>
        <file>
          <exists>${user.home}/.m2/toolchains.xml</exists>
        </file>
      </activation>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <configuration>
              <reportFormat>plain</reportFormat>
              <consoleOutputReporter>
                <disable>true</disable>
              </consoleOutputReporter>
              <statelessTestsetInfoReporter implementation="org.apache.maven.plugin.surefire.extensions.junit5.JUnit5StatelessTestsetInfoTreeReporter" />
            </configuration>
            <dependencies>
              <dependency>
                <groupId>me.fabriciorby</groupId>
                <artifactId>maven-surefire-junit5-tree-reporter</artifactId>
                <version>${maven-surefire-junit5-tree-reporter.version}</version>
              </dependency>
            </dependencies>
            <executions>
              <execution>
                <id>default-test</id>
                <configuration>
                  <jdkToolchain>
                    <version>[1.8,9)</version>
                  </jdkToolchain>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>release</id>
      <activation>
        <activeByDefault>false</activeByDefault>
      </activation>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-enforcer-plugin</artifactId>
            <executions>
              <execution>
                <id>enforce-build-environment</id>
                <configuration>
                  <rules>
                    <requireJavaVersion>
                      <display>true</display>
                      <version>[${min.jdk.version},${max.jdk.version})</version>
                      <message>To release this library you need JDK ${min.jdk.version}.</message>
                    </requireJavaVersion>
                  </rules>
                </configuration>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <goals>
                  <goal>sign</goal>
                </goals>
                <phase>verify</phase>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>