Built by Maven

Apache Software Foundation Parent POM

This project consists of a POM that contains settings that are likely to be useful to any Apache project that is building and releasing code with Maven. By using this project as a parent, a project gets these settings.

Most projects will want to override some of these settings.

The following is a list of the items configured in this POM:

  • Top-level project properties:
  • pluginManagement: The plugin management section specifies versions of a list of plugins. See the Plugin Management report for the complete list with versions.
    • There are used properties version.<artifactId> for defining each version of plugin, except:
      • version.apache-resource-bundles is used for: apache-jar-resource-bundle and apache-source-release-assembly-descriptor
      • version.maven-plugin-tools is used for: maven-plugin-annotations, maven-plugin-plugin and maven-plugin-report-plugin
      • version.maven-surefire is used for: maven-failsafe-plugin, maven-surefire-plugin and maven-surefire-report-plugin
    • The compiler plugin is set target Java 7 (maven.compiler.target property) and assume UTF-8 source encoding (project.build.sourceEncoding property). When being executed with JDK 9 or newer also maven.compiler.release is set to the value of property maven.compiler.target. Therefore its value must not start with 1. (use for example 8 instead of 1.8).
    • The jar plugin is set to add default specification and implementation entries.
    • The resources plugin is set for UTF-8.
    • The release plugin is set, via the
      • <useReleaseProfiles> configuration element, to enable theapache-release profile during release:perform execution
      • disable <useReleaseProfiles>
      • enable <autoVersionSubmodules>
  • plugins: The plugins section configures three executions:
    • maven-remote-resources-plugin for org.apache.apache.resources:apache-jar-resource-bundle:1.5.
    • maven-enforcer-plugin to check Maven and Java build prerequisites, configured via properties:
      • minimalMavenBuildVersion property: default value is Maven 3.6.3
      • minimalJavaBuildVersion property: default value is Java 1.8
  • Reproducible Builds: since version 22 of this parent POM, managed plugins versions are expected to be compliant with Reproducible Builds.

    To choose their own release timestamp in output archives, projects using this POM as parent should override with a property in their root POM:

      <properties>
    <project.build.outputTimestamp>10</project.build.outputTimestamp>
  </properties>

    The value will be updated by Maven Release Plugin during releases. If a project wants to disable Reproducible Builds, just define the property value with any single non-numeric character.

The apache-release Profile

As noted above, this pom configures the release plugin to enable the apache-release profile for all executions of the release plugin.

The profile includes the following plugins:

  • maven-assembly-plugin

    org.apache.apache.resources:apache-source-release-assembly-descriptor:1.5 is added as dependency, and an execution is configured with source-release-assembly id.
    The plugin is configured to take a descriptorRef name from the sourceReleaseAssemblyDescriptor property, which by default is set to source-release (zip only): you can override the property with source-release-zip-tar (both zip and tar) or source-release-tar (tar only) values.
    If you want to avoid this default assembly execution to provide your own mechanism to produce the source release archive, you can disable the execution by configuring skipAssembly parameter for this source-release-assembly execution id

  • maven-source-plugin

    Configured to build and attach a source jar.

  • maven-javadoc-plugin

    Configured to build and attach a javadoc jar.

  • maven-gpg-plugin

    Configured to sign everything.

    On developer workstations it expects GnuPG agent to be available to get passphrases, while on fully unattended (CI-like) workflows the use of MAVEN_GPG_PASSPHRASE environment variable use is recommended.

  • checksum-maven-plugin

    Configured to create a checksum file(s) for source release as required by Apache release distribution policy.

When doing a release with maven-release-plugin, this creates files in target/checkout/target ready to be copied to projects' Apache /dist/ release distribution directory:

  • ${artifactId}-${version}-source-release.[zip|tar.gz]: the source release archive(s)
  • ${artifactId}-${version}-source-release.[zip|tar.gz].sha512: their checksum(s)
  • ${artifactId}-${version}-source-release.[zip|tar.gz].asc: their signature(s)

Those files also end up in the staging repository and Maven Central.

Settings Configuration

You can have a look at the page in Apache website Publishing Maven Artifacts.

You can test your environment setup using -Papache-release with the command line.

Notices

  • Since version 32 maven-site-plugin:attach-descriptor was removed from plugins section.

    Publishing a site descriptor is only needed in project parent poms, child projects not need publish it.

    When you need publish site descriptor in your project you should add, like:

    <build>
  <plugins>
    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-site-plugin</artifactId>
      <inherited>false</inherited>
      <executions>
        <execution>
          <id>attach-descriptor</id>
          <goals>
            <goal>attach-descriptor</goal>
          </goals>
        </execution>
      </executions>
    </plugin>
  </plugins>
</build>