<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.google.security</groupId>
  <artifactId>fences</artifactId>
  <packaging>pom</packaging>
  <version>1.9-beta</version>

  <name>Fences</name>
  <description>
  Augments Java's access control by checking that a Maven Project and all its
  dependencies conform to a policy that specifies which classes/packages can
  link to which others.
  </description>
  <url>https://github.com/mikesamuel/fences-maven-enforcer-rule</url>

  <modules>
    <module>common</module>
    <module>rule</module>
  </modules>

  <licenses>
    <license>
      <!-- Per https://repo.maven.apache.org/maven2/org/apache/apache/2/apache-2.pom -->
      <name>The Apache Software License, Version 2.0</name>
      <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <name>Mike Samuel</name>
      <email>mikesamuel@gmail.com</email>
      <organization>Google ISE</organization>
      <organizationUrl>https://www.google.com/about/appsecurity/</organizationUrl>
    </developer>
  </developers>

  <organization>
    <name>Google ISE</name>
    <url>https://www.google.com/about/appsecurity/</url>
  </organization>

  <scm>
    <connection>scm:git:https://github.com/mikesamuel/fences-maven-enforcer-rule.git</connection>
    <developerConnection>scm:git:https://github.com/mikesamuel/fences-maven-enforcer-rule.git</developerConnection>
    <url>https://github.com/mikesamuel/fences-maven-enforcer-rule</url>
    <tag>HEAD</tag>
  </scm>

  <issueManagement>
    <system>GitHub</system>
    <url>https://github.com/mikesamuel/fences-maven-enforcer-rule/issues</url>
  </issueManagement>

  <mailingLists>
    <mailingList>
      <name>User Support List</name>
      <subscribe>fences-maven-enforcer-rule-support+subscribe@googlegroups.com</subscribe>
      <unsubscribe>fences-maven-enforcer-rule-support+unsubscribe@googlegroups.com</unsubscribe>
      <archive>https://groups.google.com/forum/#!forum/fences-maven-enforcer-rule</archive>
    </mailingList>
  </mailingLists>

  <distributionManagement>
    <snapshotRepository>
      <id>ossrh</id>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
    </snapshotRepository>
    <repository>
      <id>ossrh</id>
      <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
    </repository>
  </distributionManagement>


  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <build.plugins.plugin.version>2.3.2</build.plugins.plugin.version>
    <api.version>1.4.1</api.version>
    <maven.version>2.0.9</maven.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.apache.maven.enforcer</groupId>
        <artifactId>enforcer-api</artifactId>
        <version>${api.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.maven</groupId>
        <artifactId>maven-model</artifactId>
        <version>${maven.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.maven</groupId>
        <artifactId>maven-project</artifactId>
        <version>${maven.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.maven</groupId>
        <artifactId>maven-artifact</artifactId>
        <version>${maven.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.maven</groupId>
        <artifactId>maven-plugin-api</artifactId>
        <version>${maven.version}</version>
      </dependency>
      <dependency>
        <groupId>org.apache.maven.shared</groupId>
        <artifactId>maven-dependency-tree</artifactId>
        <version>2.2</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.plexus</groupId>
        <artifactId>plexus-utils</artifactId>
        <version>1.5.1</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.plexus</groupId>
        <artifactId>plexus-container-default</artifactId>
        <version>1.6</version>
        <exclusions>
          <exclusion>
            <groupId>com.google.collections</groupId>
            <artifactId>google-collections</artifactId>
          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.codehaus.plexus</groupId>
        <artifactId>plexus-classworlds</artifactId>
        <version>2.5.2</version>
      </dependency>
      <dependency>
        <groupId>org.codehaus.plexus</groupId>
        <artifactId>plexus-interpolation</artifactId>
        <version>1.22</version>
      </dependency>

      <!-- For basic collection types and functional operators -->
      <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>19.0</version>
      </dependency>
      <dependency>
        <!-- TODO: we shouldn't need this but dependency:analyze insists -->
        <groupId>com.google.collections</groupId>
        <artifactId>google-collections</artifactId>
        <version>1.0</version>
        <scope>compile</scope>
      </dependency>
      <!-- For classfile introspection to find the link points
           that we need to check for policy compliance -->
      <dependency>
        <groupId>org.ow2.asm</groupId>
        <artifactId>asm</artifactId>
        <version>5.1</version>
      </dependency>
      <!-- For persisting a map of subtype relationships in
           the core Java libraries so that we don't have
           to scan system JARs every time we build an
           inheritance graph.
      -->
      <dependency>
        <groupId>com.sleepycat</groupId>
        <artifactId>je</artifactId>
        <version>5.0.73</version>
      </dependency>
      <!-- For annotating classes to avoid NPEs -->
      <dependency>
        <groupId>com.google.code.findbugs</groupId>
        <artifactId>jsr305</artifactId>
        <version>3.0.1</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>4.12</version>
        <scope>test</scope>
      </dependency>
      <dependency>
        <groupId>org.apache.maven.shared</groupId>
        <artifactId>maven-verifier</artifactId>
        <version>1.6</version>
        <scope>test</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.5.1</version>
          <configuration>
            <source>1.6</source>
            <target>1.6</target>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>findbugs-maven-plugin</artifactId>
          <version>3.0.0</version>
          <configuration>
            <includeTests>true</includeTests>
          </configuration>
          <executions>
            <execution>
              <id>run-findbugs-fornullchecks</id>
              <goals>
                <goal>check</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-pmd-plugin</artifactId>
          <version>3.6</version>
          <executions>
            <execution>
              <goals>
                <goal>check</goal>
                <goal>cpd-check</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-site-plugin</artifactId>
          <version>3.5</version>
          <dependencies>
            <dependency>
              <groupId>org.apache.maven.doxia</groupId>
              <artifactId>doxia-module-markdown</artifactId>
              <version>1.7</version>
            </dependency>
          </dependencies>
          <configuration>
            <!-- deploy handled by github site-maven-plugin -->
            <skipDeploy>true</skipDeploy>
          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-project-info-reports-plugin</artifactId>
          <version>2.8.1</version>
        </plugin>

        <plugin>
          <groupId>org.sonatype.plugins</groupId>
          <artifactId>nexus-staging-maven-plugin</artifactId>
          <version>1.6.3</version>
          <extensions>true</extensions>
          <configuration>
            <serverId>ossrh</serverId>
            <nexusUrl>https://oss.sonatype.org/</nexusUrl>
            <autoReleaseAfterClose>true</autoReleaseAfterClose>
            <!-- This staging profile ID gleaned by logging in to
                 oss.sonatype.org, clicking "Staging Profiles" on the left,
                 selecting "com.googlecode.owasp-java-html-sanitizer",
                 and extracting the most hexy looking bit from the URL which
                 looks like
                 https://oss.sonatype.org/#stagingProfiles;5fd62edf6679f6
            -->
            <!--stagingProfileId>TODO</stagingProfileId-->
            <executions>
              <execution>
                <id>default-deploy</id>
                <phase>deploy</phase>
                <goals>
                  <goal>deploy</goal>
                </goals>
              </execution>
            </executions>
          </configuration>
        </plugin>
        <!-- For building the source jar. -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-source-plugin</artifactId>
          <version>2.2.1</version>
          <executions>
            <execution>
              <id>attach-sources</id>
              <goals>
                <goal>jar-no-fork</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
        <!-- For building the javadoc jar. -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-javadoc-plugin</artifactId>
          <version>2.9.1</version>
          <executions>
            <execution>
              <id>attach-javadocs</id>
              <goals>
                <goal>jar</goal>
              </goals>
            </execution>
          </executions>
          <configuration>
            <nohelp>true</nohelp>
            <show>public</show>
            <charset>UTF-8</charset>
            <doctitle>OWASP HTML Sanitizer</doctitle>
            <excludePackageNames>*.example</excludePackageNames>
            <!-- The Javadoc that ships with JDK 8 is spammy.
                 http://docs.oracle.com/javase/8/docs/technotes/tools/unix/javadoc.html#BEJEFABE -->
            <additionalparam>-Xdoclint:-missing</additionalparam>
          </configuration>
        </plugin>
        <!-- Seal the JAR -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>2.6</version>
          <configuration>
            <archive>
              <manifest>
                <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
                <addDefaultSpecificationEntries>true</addDefaultSpecificationEntries>
              </manifest>
              <manifestEntries>
                <Sealed>true</Sealed>
              </manifestEntries>
            </archive>
          </configuration>
        </plugin>
        <!-- http://www.javaworld.com/article/2074515/core-java/
             unit-test-code-coverage-with-maven-and-jacoco.html -->
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>0.7.5.201505241946</version>
          <configuration>
            <destFile>${basedir}/target/coverage-reports/jacoco-unit.exec</destFile>
            <dataFile>${basedir}/target/coverage-reports/jacoco-unit.exec</dataFile>
          </configuration>
          <executions>
            <execution>
              <id>jacoco-initialize</id>
              <goals>
                <goal>prepare-agent</goal>
              </goals>
            </execution>
            <execution>
              <id>jacoco-site</id>
              <phase>package</phase>
              <goals>
                <goal>report</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-enforcer-plugin</artifactId>
          <version>1.3.1</version>
          <dependencies>
            <dependency>
              <groupId>org.codehaus.mojo</groupId>
              <artifactId>extra-enforcer-rules</artifactId>
              <version>1.0-beta-4</version>
            </dependency>
          </dependencies>
          <executions>
            <execution>
              <id>enforce</id>
              <configuration>
                <rules>
                  <DependencyConvergence />
                  <banDuplicateClasses>
                    <findAllDuplicates>true</findAllDuplicates>
                    <ignoreClasses>
                    </ignoreClasses>
                  </banDuplicateClasses>
                </rules>
                <fail>true</fail>
              </configuration>
              <goals>
                <goal>enforce</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
      </plugins>
    </pluginManagement>
  </build>

  <profiles>
    <profile>
      <id>release-sign-artifact</id>
      <activation>
        <property>
          <name>performRelease</name>
          <value>true</value>
        </property>
      </activation>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>1.5</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>
