Apache Software Foundation Parent POM

This project consists of a POM that contains settings that are likely to be useful to any Apache project that is building and releasing code with Maven. By using this project as a parent, a project gets these settings.

Most projects will want to override some of these settings.

The following is a list of the items configured in this POM:

• Top-level project properties:
  • license: Apache-2.0.
  • organization: The Apache Software Foundation
  • url: https://www.apache.org/. You should override this.
  • repositories: The pom adds the Apache snapshot repository (https://repository.apache.org/snapshots)
  • distributionManagement: The POM sets up for releases to the Apache Nexus instance at https://repository.apache.org/service/local/staging/deploy/maven2 and snapshots to https://repository.apache.org/content/repositories/snapshots.
    Note that there are distMgmt(Releases|Snapshots)(Name|Url) POM properties (distMgmtReleasesName, distMgmtReleasesUrl, distMgmtSnapshotsName and distMgmtSnapshotsUrl) that you can override to change the names and locations.
  • mailingLists: The POM sets up generic Apache announcement lists. You should override this.
• pluginManagement: The plugin management section specifies versions of a list of plugins. See the Plugin Management report for the complete list with versions.
  • There are used properties version.<artifactId> for defining each version of plugin, except:
    • version.apache-resource-bundles is used for: apache-jar-resource-bundle and apache-source-release-assembly-descriptor
    • version.maven-plugin-tools is used for: maven-plugin-annotations, maven-plugin-plugin and maven-plugin-report-plugin
    • version.maven-surefire is used for: maven-failsafe-plugin, maven-surefire-plugin and maven-surefire-report-plugin
  • The compiler plugin is set to default to Java 1.7 (maven.compiler.target property) and UTF-8 source (project.build.sourceEncoding property).
  • The jar plugin is set to add default specification and implementation entries.
  • The resources plugin is set for UTF-8.
  • The release plugin is set, via the <useReleaseProfiles> configuration element, to enable the apache-release profile during release:perform execution and to disable <useReleaseProfiles>.
• plugins: The plugins section configures three executions:
  • maven-remote-resources-plugin for org.apache.apache.resources:apache-jar-resource-bundle:1.5.
  • maven-site-plugin:attach-descriptor
  • maven-enforcer-plugin to check Maven and Java build prerequisites, configured via properties:
    • minimalMavenBuildVersion property: default value is Maven 3.2.5
    • minimalJavaBuildVersion property: default value is Java 1.8
• Reproducible Builds: since version 22 of this parent POM, managed plugins versions are expected to be compliant with Reproducible Builds.

  To choose their own release timestamp in output archives, projects using this POM as parent should override with a property in their root POM:

    <properties>
      <project.build.outputTimestamp>10</project.build.outputTimestamp>
    </properties>

  The value will be updated by Maven Release Plugin during releases. If a project wants to disable Reproducible Builds, just define the property value with any single non-numeric character.

The apache-release Profile

As noted above, this pom configures the release plugin to enable the apache-release profile for all executions of the release plugin.

The profile includes the following plugins:

• maven-assembly-plugin: org.apache.apache.resources:apache-source-release-assembly-descriptor:1.5 is added as dependency, and an execution is configured with source-release-assembly id.
  The plugin is configured to take a descriptorRef name from the sourceReleaseAssemblyDescriptor property, which by default is set to source-release (zip only): you can override the property with source-release-zip-tar (both zip and tar) or source-release-tar (tar only) values.
  If you want to avoid this default assembly execution to provide your own mechanism to produce the source release archive, you can disable the execution by configuring skipAssembly parameter for this source-release-assembly execution id
• maven-source-plugin: configured to build and attach a source jar.
• maven-javadoc-plugin: configured to build and attach a javadoc jar.
• maven-gpg-plugin: configured to sign everything. It expects to find a passphrase in ${gpg.passphrase}, presumably in your settings.xml.
• checksum-maven-plugin: configured to create a checksum file(s) for source release as required by Apache release distribution policy.

When doing a release with maven-release-plugin, this creates files in target/checkout/target ready to be copied to projects' Apache /dist/ release distribution directory:

• ${artifactId}-${version}-source-release.[zip|tar.gz]: the source release archive(s)
• ${artifactId}-${version}-source-release.[zip|tar.gz].sha512: their checksum(s)
• ${artifactId}-${version}-source-release.[zip|tar.gz].asc: their signature(s)

Those files also end up in the staging repository and Maven Central.

Settings Configuration

You can have a look at the page in Apache website Publishing Maven Artifacts.

You can test your environment setup using -Papache-release with the command line.

History