<?xml version="1.0" encoding="UTF-8"?>
<!--
  This file is part of Alpine.

  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.

  Copyright (c) Steve Springett. All Rights Reserved.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>us.springett</groupId>
    <artifactId>alpine-parent</artifactId>
    <packaging>pom</packaging>
    <version>1.4.2</version>

    <modules>
        <module>alpine</module>
    </modules>

    <name>Alpine Parent POM</name>
    <description>
        An opinionated scaffolding library that jumpstarts Java projects with an API-first design,
        secure defaults, and minimal dependencies.
    </description>
    <url>https://github.com/stevespringett/Alpine</url>
    <inceptionYear>2016</inceptionYear>

    <licenses>
        <license>
            <name>Apache-2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <name>Steve Springett</name>
            <organizationUrl>http://stevespringett.com/</organizationUrl>
            <roles>
                <role>Architect</role>
                <role>Developer</role>
            </roles>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:git@github.com:stevespringett/Alpine.git</connection>
        <url>https://github.com/stevespringett/Alpine.git</url>
        <developerConnection>scm:git:git@github.com:stevespringett/Alpine.git</developerConnection>
        <tag>alpine-parent-1.4.2</tag>
    </scm>

    <issueManagement>
        <system>GitHub</system>
        <url>https://github.com/stevespringett/Alpine/issues</url>
    </issueManagement>

    <ciManagement>
        <system>travis-ci</system>
        <url>https://travis-ci.org/stevespringett/Alpine</url>
    </ciManagement>

    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
        <repository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
        </repository>
    </distributionManagement>

    <properties>
        <!-- Maven Build Properties -->
        <maven.build.timestamp.format>yyyy-MM-dd HH:mm:ss</maven.build.timestamp.format>
        <maven.compiler.source>1.8</maven.compiler.source>
        <maven.compiler.target>1.8</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <timestamp>${maven.build.timestamp}</timestamp>

        <!-- Maven Plugin Versions -->
        <maven.compiler.plugin.version>3.8.0</maven.compiler.plugin.version>
        <maven.dependency.plugin.version>3.1.1</maven.dependency.plugin.version>
        <maven.javadoc.plugin.version>3.0.1</maven.javadoc.plugin.version>
        <maven.site.plugin.version>3.7.1</maven.site.plugin.version>
        <maven.source.plugin.version>3.0.1</maven.source.plugin.version>
        <maven.surefire.plugin.version>2.22.0</maven.surefire.plugin.version>
        <maven.war.plugin.version>3.2.2</maven.war.plugin.version>
        <maven.datanucleus.plugin.version>5.0.2</maven.datanucleus.plugin.version>
        <maven.versions.plugin.version>2.7</maven.versions.plugin.version>
        <maven.gpg.plugin.version>1.5</maven.gpg.plugin.version>
        <maven.enforcer.plugin.version>1.4.1</maven.enforcer.plugin.version>
        <maven.uuidgenerator.plugin.version>1.0.1</maven.uuidgenerator.plugin.version>

        <!-- Software Security: Fortify SCA -->
        <maven.fortify.plugin.version>18.10</maven.fortify.plugin.version>
        <plugin.fortify.sca.debug>false</plugin.fortify.sca.debug>
        <plugin.fortify.sca.verbose>false</plugin.fortify.sca.verbose>
        <plugin.fortify.sca.sourcePath>${project.build.directory}/dependency-sources</plugin.fortify.sca.sourcePath>
        <plugin.fortify.sca.buildId>${project.artifactId}</plugin.fortify.sca.buildId>
        <plugin.fortify.sca.source.version>${maven.compiler.source}</plugin.fortify.sca.source.version>
        <plugin.fortify.sca.findbugs>false</plugin.fortify.sca.findbugs>

        <!-- Software Security: OWASP Dependency-Check -->
        <maven.dependency-check.plugin.version>3.3.2</maven.dependency-check.plugin.version>
        <plugin.dependency-check.autoUpdate>true</plugin.dependency-check.autoUpdate>
        <plugin.dependency-check.format>ALL</plugin.dependency-check.format>
        <plugin.dependency-check.skipTestScope>true</plugin.dependency-check.skipTestScope>
        <plugin.dependency-check.suppressionFile>${env.DEPENDENCY-CHECK_SUPPRESSION}</plugin.dependency-check.suppressionFile>
        <plugin.dependency-check.analyzer.archiveAnalyzerEnabled>false</plugin.dependency-check.analyzer.archiveAnalyzerEnabled>
        <plugin.dependency-check.analyzer.assemblyAnalyzerEnabled>false</plugin.dependency-check.analyzer.assemblyAnalyzerEnabled>
        <plugin.dependency-check.analyzer.autoconfAnalyzerEnabled>false</plugin.dependency-check.analyzer.autoconfAnalyzerEnabled>
        <plugin.dependency-check.analyzer.bundleAuditAnalyzerEnabled>false</plugin.dependency-check.analyzer.bundleAuditAnalyzerEnabled>
        <plugin.dependency-check.analyzer.bundleAuditPath />
        <plugin.dependency-check.analyzer.centralAnalyzerEnabled>true</plugin.dependency-check.analyzer.centralAnalyzerEnabled>
        <plugin.dependency-check.analyzer.cmakeAnalyzerEnabled>false</plugin.dependency-check.analyzer.cmakeAnalyzerEnabled>
        <plugin.dependency-check.analyzer.cocoapodsAnalyzerEnabled>false</plugin.dependency-check.analyzer.cocoapodsAnalyzerEnabled>
        <plugin.dependency-check.analyzer.composerAnalyzerEnabled>false</plugin.dependency-check.analyzer.composerAnalyzerEnabled>
        <plugin.dependency-check.analyzer.jarAnalyzer>true</plugin.dependency-check.analyzer.jarAnalyzer>
        <plugin.dependency-check.analyzer.nexusAnalyzerEnabled>false</plugin.dependency-check.analyzer.nexusAnalyzerEnabled>
        <plugin.dependency-check.analyzer.nexusUrl />
        <plugin.dependency-check.analyzer.nexusUsesProxy />
        <plugin.dependency-check.analyzer.nodeAnalyzerEnabled>true</plugin.dependency-check.analyzer.nodeAnalyzerEnabled>
        <plugin.dependency-check.analyzer.nspAnalyzerEnabled>true</plugin.dependency-check.analyzer.nspAnalyzerEnabled>
        <plugin.dependency-check.analyzer.nuspecAnalyzerEnabled>false</plugin.dependency-check.analyzer.nuspecAnalyzerEnabled>
        <plugin.dependency-check.analyzer.opensslAnalyzerEnabled>false</plugin.dependency-check.analyzer.opensslAnalyzerEnabled>
        <plugin.dependency-check.analyzer.pyDistributionAnalyzerEnabled>false</plugin.dependency-check.analyzer.pyDistributionAnalyzerEnabled>
        <plugin.dependency-check.analyzer.pyPackageAnalyzerEnabled>false</plugin.dependency-check.analyzer.pyPackageAnalyzerEnabled>
        <plugin.dependency-check.analyzer.rubygemsAnalyzerEnabled>false</plugin.dependency-check.analyzer.rubygemsAnalyzerEnabled>
        <plugin.dependency-check.analyzer.swiftPackageManagerAnalyzerEnabled>false</plugin.dependency-check.analyzer.swiftPackageManagerAnalyzerEnabled>

        <!-- Software Security: Retire.js -->
        <maven.retirejs.plugin.version>3.0.1</maven.retirejs.plugin.version>
        <plugin.retirejs.breakOnFailure>true</plugin.retirejs.breakOnFailure>
        <plugin.retirejs.webAppDir>${project.build.sourceDirectory}/../webapp</plugin.retirejs.webAppDir>
        <plugin.retirejs.detail>true</plugin.retirejs.detail>
        <plugin.retirejs.indentSize>4</plugin.retirejs.indentSize>

        <!-- Software Analysis: CycloneDX -->
        <maven.cyclonedx.plugin.version>1.1.2</maven.cyclonedx.plugin.version>
        <plugin.cyclonedx.includeCompileScope>true</plugin.cyclonedx.includeCompileScope>
        <plugin.cyclonedx.includeProvidedScope>true</plugin.cyclonedx.includeProvidedScope>
        <plugin.cyclonedx.includeRuntimeScope>true</plugin.cyclonedx.includeRuntimeScope>
        <plugin.cyclonedx.includeSystemScope>true</plugin.cyclonedx.includeSystemScope>
        <plugin.cyclonedx.includeTestScope>false</plugin.cyclonedx.includeTestScope>

        <!-- Dependency Versions -->
        <lib.alpine.executable.war.version>1.1.0</lib.alpine.executable.war.version>
        <lib.bcrypt.version>0.4</lib.bcrypt.version>
        <lib.commons.collections4.version>4.2</lib.commons.collections4.version>
        <lib.commons.io.version>2.6</lib.commons.io.version>
        <lib.commons.lang3.version>3.8.1</lib.commons.lang3.version>
        <lib.datanucleus-api-jdo.version>5.1.6</lib.datanucleus-api-jdo.version>
        <!-- Auto-generated classes have warnings which break build
             https://github.com/datanucleus/datanucleus-jdo-query/pull/10
        <lib.datanucleus-jdo-query.version>5.0.6</lib.datanucleus-jdo-query.version>
        -->
        <lib.datanucleus.version>5.1.9</lib.datanucleus.version>
        <lib.h2.version>1.4.197</lib.h2.version>
        <lib.hikaricp.version>3.2.0</lib.hikaricp.version>
        <lib.javassist.version>3.22.0-GA</lib.javassist.version>
        <lib.jackson.version>2.9.7</lib.jackson.version>
        <lib.javamail.version>1.6.2</lib.javamail.version>
        <lib.jdo.api.version>3.2.0-m8</lib.jdo.api.version>
        <lib.jersey.version>2.27</lib.jersey.version>
        <lib.jsp.api.version>2.2</lib.jsp.api.version>
        <lib.jsonwebtoken.version>0.9.1</lib.jsonwebtoken.version>
        <lib.jsr305.version>3.0.2</lib.jsr305.version>
        <lib.jsr353-impl.version>1.1.3</lib.jsr353-impl.version>
        <lib.jsr353-spec.version>1.1.3</lib.jsr353-spec.version>
        <lib.jstl.version>1.2.5</lib.jstl.version>
        <lib.logback.version>1.2.3</lib.logback.version>
        <lib.owasp.encoder.version>1.2.2</lib.owasp.encoder.version>
        <lib.owasp.security-logging.version>1.1.6</lib.owasp.security-logging.version>
        <lib.slf4j.version>1.7.25</lib.slf4j.version>
        <lib.swagger.jersey.version>1.5.21</lib.swagger.jersey.version>

        <!-- Logback configuration - Used for Embedded Jetty profile -->
        <logback.configuration.file>${project.build.directory}/classes/logback.xml</logback.configuration.file>
    </properties>

    <dependencies>
        <!-- Misc helper libraries -->
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>${lib.commons.io.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>${lib.commons.lang3.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-collections4</artifactId>
            <version>${lib.commons.collections4.version}</version>
        </dependency>
        <!-- Server architecture -->
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>7.0</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>3.1.0</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.containers</groupId>
            <artifactId>jersey-container-servlet</artifactId>
            <version>${lib.jersey.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.media</groupId>
            <artifactId>jersey-media-json-jackson</artifactId>
            <version>${lib.jersey.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.media</groupId>
            <artifactId>jersey-media-multipart</artifactId>
            <version>${lib.jersey.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.ext</groupId>
            <artifactId>jersey-bean-validation</artifactId>
            <version>${lib.jersey.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.inject</groupId>
            <artifactId>jersey-hk2</artifactId>
            <version>${lib.jersey.version}</version>
        </dependency>
        <!-- JSON API specification and default implementation of JSR 353 -->
        <dependency>
            <groupId>javax.json</groupId>
            <artifactId>javax.json-api</artifactId>
            <version>${lib.jsr353-spec.version}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish</groupId>
            <artifactId>javax.json</artifactId>
            <version>${lib.jsr353-impl.version}</version>
        </dependency>
        <!-- JSP API's -->
        <dependency>
            <groupId>javax.servlet.jsp</groupId>
            <artifactId>jsp-api</artifactId>
            <version>${lib.jsp.api.version}</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.taglibs</groupId>
            <artifactId>taglibs-standard-impl</artifactId>
            <version>${lib.jstl.version}</version>
        </dependency>
        <!-- todo: update swagger when available -->
        <!-- https://github.com/swagger-api/swagger-core/issues/1594 -->
        <dependency>
            <groupId>io.swagger</groupId>
            <artifactId>swagger-jersey2-jaxrs</artifactId>
            <version>${lib.swagger.jersey.version}</version>
        </dependency>
        <!-- Persistence -->
        <dependency>
            <groupId>org.datanucleus</groupId>
            <artifactId>javax.jdo</artifactId>
            <version>${lib.jdo.api.version}</version>
        </dependency>
        <dependency>
            <groupId>org.datanucleus</groupId>
            <artifactId>datanucleus-api-jdo</artifactId>
            <version>${lib.datanucleus-api-jdo.version}</version>
        </dependency>
        <dependency>
            <groupId>org.datanucleus</groupId>
            <artifactId>datanucleus-core</artifactId>
            <version>${lib.datanucleus.version}</version>
        </dependency>
        <dependency>
            <groupId>org.datanucleus</groupId>
            <artifactId>datanucleus-rdbms</artifactId>
            <version>${lib.datanucleus.version}</version>
        </dependency>
        <!--
        <dependency>
            <groupId>org.datanucleus</groupId>
            <artifactId>datanucleus-jdo-query</artifactId>
            <version>${lib.datanucleus-jdo-query.version}</version>
        </dependency>
        -->
        <dependency>
            <groupId>com.zaxxer</groupId>
            <artifactId>HikariCP</artifactId>
            <version>${lib.hikaricp.version}</version>
        </dependency>
        <dependency>
            <groupId>org.javassist</groupId>
            <artifactId>javassist</artifactId>
            <version>${lib.javassist.version}</version>
        </dependency>
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <version>${lib.h2.version}</version>
        </dependency>
        <!-- Authentication and Authorization -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>${lib.jsonwebtoken.version}</version>
        </dependency>
        <dependency>
            <groupId>org.mindrot</groupId>
            <artifactId>jbcrypt</artifactId>
            <version>${lib.bcrypt.version}</version>
        </dependency>
        <!-- JAX-RS JSON -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>${lib.jackson.version}</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
            <version>${lib.jackson.version}</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.jaxrs</groupId>
            <artifactId>jackson-jaxrs-base</artifactId>
            <version>${lib.jackson.version}</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.jaxrs</groupId>
            <artifactId>jackson-jaxrs-json-provider</artifactId>
            <version>${lib.jackson.version}</version>
        </dependency>
        <!-- Logging -->
        <!-- Overriding OWASP Security Logging dependencies with newer versions -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>${lib.slf4j.version}</version>
        </dependency>
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <version>${lib.logback.version}</version>
        </dependency>
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
            <version>${lib.logback.version}</version>
        </dependency>
        <dependency>
            <groupId>org.owasp</groupId>
            <artifactId>security-logging-common</artifactId>
            <version>${lib.owasp.security-logging.version}</version>
        </dependency>
        <dependency>
            <groupId>org.owasp</groupId>
            <artifactId>security-logging-logback</artifactId>
            <version>${lib.owasp.security-logging.version}</version>
        </dependency>
        <!-- XSS prevention -->
        <dependency>
            <groupId>org.owasp.encoder</groupId>
            <artifactId>encoder</artifactId>
            <version>${lib.owasp.encoder.version}</version>
        </dependency>
        <dependency>
            <groupId>org.owasp.encoder</groupId>
            <artifactId>encoder-jsp</artifactId>
            <version>${lib.owasp.encoder.version}</version>
        </dependency>
        <!-- Executable WAR with embedded Jetty -->
        <dependency>
            <groupId>us.springett</groupId>
            <artifactId>alpine-executable-war</artifactId>
            <version>${lib.alpine.executable.war.version}</version>
            <scope>provided</scope>
        </dependency>
        <!-- JavaMail API -->
        <dependency>
            <groupId>com.sun.mail</groupId>
            <artifactId>javax.mail</artifactId>
            <version>${lib.javamail.version}</version>
        </dependency>
        <!-- Quality -->
        <dependency>
            <groupId>com.google.code.findbugs</groupId>
            <artifactId>jsr305</artifactId>
            <version>${lib.jsr305.version}</version>
        </dependency>
        <!-- Unit Tests -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jersey.test-framework.providers</groupId>
            <artifactId>jersey-test-framework-provider-grizzly2</artifactId>
            <version>${lib.jersey.version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <prerequisites>
        <maven>3.1</maven>
    </prerequisites>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>${maven.compiler.plugin.version}</version>
                <configuration>
                    <source>${maven.compiler.source}</source>
                    <target>${maven.compiler.target}</target>
                    <compilerArgs>
                        <arg>-Xlint:all</arg>
                        <arg>-Xlint:-processing</arg>
                        <arg>-Xlint:-serial</arg>
                        <arg>-Werror</arg>
                    </compilerArgs>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${maven.surefire.plugin.version}</version>
            </plugin>
            <plugin>
                <groupId>org.datanucleus</groupId>
                <artifactId>datanucleus-maven-plugin</artifactId>
                <version>${maven.datanucleus.plugin.version}</version>
                <configuration>
                    <api>JDO</api>
                    <persistenceUnitName>Alpine</persistenceUnitName>
                    <verbose>true</verbose>
                    <fork>false</fork>
                </configuration>
                <executions>
                    <execution>
                        <phase>compile</phase>
                        <goals>
                            <goal>enhance</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>us.springett</groupId>
                <artifactId>maven-uuid-generator</artifactId>
                <version>${maven.uuidgenerator.plugin.version}</version>
                <executions>
                    <execution>
                        <id>generate-uuid</id>
                        <phase>initialize</phase>
                        <goals>
                            <goal>generate</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>

        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>false</filtering>
            </resource>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>true</filtering>
                <includes>
                    <include>application.properties</include>
                </includes>
            </resource>
        </resources>
    </build>

    <profiles>
        <profile>
            <id>fortify</id>
            <!-- Only activate this profile if you're a Fortify customer, have the required
                 Fortify Maven plugin installed, and SCA installed and configured. -->
            <activation>
                <property>
                    <name>env.ACTIVATE_FORTIFY</name>
                    <value>true</value>
                </property>
            </activation>
            <build>
                <defaultGoal>process-classes</defaultGoal>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-dependency-plugin</artifactId>
                        <version>${maven.dependency.plugin.version}</version>
                        <executions>
                            <execution>
                                <id>src-dependencies</id>
                                <phase>process-sources</phase>
                                <goals>
                                    <goal>unpack-dependencies</goal>
                                </goals>
                                <configuration>
                                    <classifier>sources</classifier>
                                    <includeScope>compile</includeScope>
                                    <failOnMissingClassifierArtifact>false</failOnMissingClassifierArtifact>
                                    <outputDirectory>${plugin.fortify.sca.sourcePath}</outputDirectory>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>com.fortify.sca.plugins.maven</groupId>
                        <artifactId>sca-maven-plugin</artifactId>
                        <version>${maven.fortify.plugin.version}</version>
                        <configuration>
                            <buildId>${plugin.fortify.sca.buildId}</buildId>
                            <sourcePath>${plugin.fortify.sca.sourcePath}</sourcePath>
                            <debug>${plugin.fortify.sca.debug}</debug>
                            <verbose>${plugin.fortify.sca.verbose}</verbose>
                            <source>${plugin.fortify.sca.source.version}</source>
                            <findbugs>${plugin.fortify.sca.findbugs}</findbugs>
                        </configuration>
                        <executions>
                            <execution>
                                <id>sca-clean</id>
                                <phase>clean</phase>
                                <goals>
                                    <goal>clean</goal>
                                </goals>
                            </execution>
                            <execution>
                                <id>sca-translate</id>
                                <phase>process-classes</phase>
                                <goals>
                                    <goal>translate</goal>
                                </goals>
                            </execution>
                            <execution>
                                <id>sca-scan</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>scan</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>component-analysis</id>
            <!-- Activate this profile to check third-party components for known vulnerabilities
                 using OWASP Dependency-Check and Retire.js. -->
            <activation>
                <property>
                    <name>env.ACTIVATE_COMPONENT_ANALYSIS</name>
                    <value>true</value>
                </property>
            </activation>
            <build>
                <defaultGoal>package</defaultGoal>
                <pluginManagement>
                    <plugins>
                        <plugin>
                            <groupId>org.owasp</groupId>
                            <artifactId>dependency-check-maven</artifactId>
                            <version>${maven.dependency-check.plugin.version}</version>
                            <configuration>
                                <autoUpdate>${plugin.dependency-check.autoUpdate}</autoUpdate>
                                <format>${plugin.dependency-check.format}</format>
                                <skipTestScope>${plugin.dependency-check.skipTestScope}</skipTestScope>
                                <suppressionFile>${plugin.dependency-check.suppressionFile}</suppressionFile>
                                <!-- Analyzer Configuration -->
                                <archiveAnalyzerEnabled>${plugin.dependency-check.analyzer.archiveAnalyzerEnabled}</archiveAnalyzerEnabled>
                                <assemblyAnalyzerEnabled>${plugin.dependency-check.analyzer.assemblyAnalyzerEnabled}</assemblyAnalyzerEnabled>
                                <autoconfAnalyzerEnabled>${plugin.dependency-check.analyzer.autoconfAnalyzerEnabled}</autoconfAnalyzerEnabled>
                                <bundleAuditAnalyzerEnabled>${plugin.dependency-check.analyzer.bundleAuditAnalyzerEnabled}</bundleAuditAnalyzerEnabled>
                                <bundleAuditPath>${plugin.dependency-check.analyzer.bundleAuditPath}</bundleAuditPath>
                                <centralAnalyzerEnabled>${plugin.dependency-check.analyzer.centralAnalyzerEnabled}</centralAnalyzerEnabled>
                                <cmakeAnalyzerEnabled>${plugin.dependency-check.analyzer.cmakeAnalyzerEnabled}</cmakeAnalyzerEnabled>
                                <cocoapodsAnalyzerEnabled>${plugin.dependency-check.analyzer.cocoapodsAnalyzerEnabled}</cocoapodsAnalyzerEnabled>
                                <composerAnalyzerEnabled>${plugin.dependency-check.analyzer.composerAnalyzerEnabled}</composerAnalyzerEnabled>
                                <jarAnalyzerEnabled>${plugin.dependency-check.analyzer.jarAnalyzer}</jarAnalyzerEnabled>
                                <nexusAnalyzerEnabled>${plugin.dependency-check.analyzer.nexusAnalyzerEnabled}</nexusAnalyzerEnabled>
                                <nexusUrl>${plugin.dependency-check.analyzer.nexusUrl}</nexusUrl>
                                <nexusUsesProxy>${plugin.dependency-check.analyzer.nexusUsesProxy}</nexusUsesProxy>
                                <nodeAnalyzerEnabled>${plugin.dependency-check.analyzer.nodeAnalyzerEnabled}</nodeAnalyzerEnabled>
                                <nspAnalyzerEnabled>${plugin.dependency-check.analyzer.nspAnalyzerEnabled}</nspAnalyzerEnabled>
                                <nuspecAnalyzerEnabled>${plugin.dependency-check.analyzer.nuspecAnalyzerEnabled}</nuspecAnalyzerEnabled>
                                <opensslAnalyzerEnabled>${plugin.dependency-check.analyzer.opensslAnalyzerEnabled}</opensslAnalyzerEnabled>
                                <pyDistributionAnalyzerEnabled>${plugin.dependency-check.analyzer.pyDistributionAnalyzerEnabled}</pyDistributionAnalyzerEnabled>
                                <pyPackageAnalyzerEnabled>${plugin.dependency-check.analyzer.pyPackageAnalyzerEnabled}</pyPackageAnalyzerEnabled>
                                <rubygemsAnalyzerEnabled>${plugin.dependency-check.analyzer.rubygemsAnalyzerEnabled}</rubygemsAnalyzerEnabled>
                                <swiftPackageManagerAnalyzerEnabled>${plugin.dependency-check.analyzer.swiftPackageManagerAnalyzerEnabled}</swiftPackageManagerAnalyzerEnabled>
                            </configuration>
                        </plugin>
                    </plugins>
                </pluginManagement>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>versions-maven-plugin</artifactId>
                        <version>${maven.versions.plugin.version}</version>
                        <inherited>true</inherited>
                        <executions>
                            <execution>
                                <id>maven-versions</id>
                                <phase>test</phase>
                                <goals>
                                    <goal>display-dependency-updates</goal>
                                    <goal>display-plugin-updates</goal>
                                    <goal>display-property-updates</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-dependency-plugin</artifactId>
                        <version>${maven.dependency.plugin.version}</version>
                        <executions>
                            <execution>
                                <id>tree-dependencies</id>
                                <phase>test</phase>
                                <goals>
                                    <goal>analyze-only</goal>
                                    <goal>tree</goal>
                                </goals>
                                <configuration>
                                    <outputFile>${project.build.directory}/dependency-tree.txt</outputFile>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>com.h3xstream.retirejs</groupId>
                        <artifactId>retirejs-maven-plugin</artifactId>
                        <version>${maven.retirejs.plugin.version}</version>
                        <configuration>
                            <breakOnFailure>${plugin.retirejs.breakOnFailure}</breakOnFailure>
                            <webAppDirectory>${plugin.retirejs.webAppDir}</webAppDirectory>
                            <detail>${plugin.retirejs.detail}</detail>
                            <indentSize>${plugin.retirejs.indentSize}</indentSize>
                        </configuration>
                        <executions>
                            <execution>
                                <id>retire-js</id>
                                <phase>test</phase>
                                <goals>
                                    <goal>scan</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>${maven.dependency-check.plugin.version}</version>
                        <executions>
                            <execution>
                                <id>dependency-check</id>
                                <phase>test</phase>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.cyclonedx</groupId>
                        <artifactId>cyclonedx-maven-plugin</artifactId>
                        <version>${maven.cyclonedx.plugin.version}</version>
                        <executions>
                            <execution>
                                <id>cyclonedx-aggregate</id>
                                <phase>test</phase>
                                <goals>
                                    <goal>makeAggregateBom</goal>
                                </goals>
                            </execution>
                        </executions>
                        <configuration>
                            <includeCompileScope>${plugin.cyclonedx.includeCompileScope}</includeCompileScope>
                            <includeProvidedScope>${plugin.cyclonedx.includeProvidedScope}</includeProvidedScope>
                            <includeRuntimeScope>${plugin.cyclonedx.includeRuntimeScope}</includeRuntimeScope>
                            <includeSystemScope>${plugin.cyclonedx.includeSystemScope}</includeSystemScope>
                            <includeTestScope>${plugin.cyclonedx.includeTestScope}</includeTestScope>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-site-plugin</artifactId>
                        <version>${maven.site.plugin.version}</version>
                        <configuration>
                            <reportPlugins combine.children="override">
                                <plugin>
                                    <groupId>org.owasp</groupId>
                                    <artifactId>dependency-check-maven</artifactId>
                                    <version>${maven.dependency-check.plugin.version}</version>
                                    <configuration>
                                        <autoUpdate>${plugin.dependency-check.autoUpdate}</autoUpdate>
                                        <format>${plugin.dependency-check.format}</format>
                                        <skipTestScope>${plugin.dependency-check.skipTestScope}</skipTestScope>
                                        <suppressionFile>${plugin.dependency-check.suppressionFile}</suppressionFile>
                                        <!-- Analyzer Configuration -->
                                        <archiveAnalyzerEnabled>${plugin.dependency-check.analyzer.archiveAnalyzerEnabled}</archiveAnalyzerEnabled>
                                        <assemblyAnalyzerEnabled>${plugin.dependency-check.analyzer.assemblyAnalyzerEnabled}</assemblyAnalyzerEnabled>
                                        <autoconfAnalyzerEnabled>${plugin.dependency-check.analyzer.autoconfAnalyzerEnabled}</autoconfAnalyzerEnabled>
                                        <bundleAuditAnalyzerEnabled>${plugin.dependency-check.analyzer.bundleAuditAnalyzerEnabled}</bundleAuditAnalyzerEnabled>
                                        <bundleAuditPath>${plugin.dependency-check.analyzer.bundleAuditPath}</bundleAuditPath>
                                        <centralAnalyzerEnabled>${plugin.dependency-check.analyzer.centralAnalyzerEnabled}</centralAnalyzerEnabled>
                                        <cmakeAnalyzerEnabled>${plugin.dependency-check.analyzer.cmakeAnalyzerEnabled}</cmakeAnalyzerEnabled>
                                        <cocoapodsAnalyzerEnabled>${plugin.dependency-check.analyzer.cocoapodsAnalyzerEnabled}</cocoapodsAnalyzerEnabled>
                                        <composerAnalyzerEnabled>${plugin.dependency-check.analyzer.composerAnalyzerEnabled}</composerAnalyzerEnabled>
                                        <jarAnalyzer>${plugin.dependency-check.analyzer.jarAnalyzer}</jarAnalyzer>
                                        <nexusAnalyzerEnabled>${plugin.dependency-check.analyzer.nexusAnalyzerEnabled}</nexusAnalyzerEnabled>
                                        <nexusUrl>${plugin.dependency-check.analyzer.nexusUrl}</nexusUrl>
                                        <nexusUsesProxy>${plugin.dependency-check.analyzer.nexusUsesProxy}</nexusUsesProxy>
                                        <nodeAnalyzerEnabled>${plugin.dependency-check.analyzer.nodeAnalyzerEnabled}</nodeAnalyzerEnabled>
                                        <nspAnalyzerEnabled>${plugin.dependency-check.analyzer.nspAnalyzerEnabled}</nspAnalyzerEnabled>
                                        <nuspecAnalyzerEnabled>${plugin.dependency-check.analyzer.nuspecAnalyzerEnabled}</nuspecAnalyzerEnabled>
                                        <opensslAnalyzerEnabled>${plugin.dependency-check.analyzer.opensslAnalyzerEnabled}</opensslAnalyzerEnabled>
                                        <pyDistributionAnalyzerEnabled>${plugin.dependency-check.analyzer.pyDistributionAnalyzerEnabled}</pyDistributionAnalyzerEnabled>
                                        <pyPackageAnalyzerEnabled>${plugin.dependency-check.analyzer.pyPackageAnalyzerEnabled}</pyPackageAnalyzerEnabled>
                                        <rubygemsAnalyzerEnabled>${plugin.dependency-check.analyzer.rubygemsAnalyzerEnabled}</rubygemsAnalyzerEnabled>
                                        <swiftPackageManagerAnalyzerEnabled>${plugin.dependency-check.analyzer.swiftPackageManagerAnalyzerEnabled}</swiftPackageManagerAnalyzerEnabled>
                                    </configuration>
                                    <reportSets>
                                        <reportSet>
                                            <reports>
                                                <report>aggregate</report>
                                            </reports>
                                        </reportSet>
                                    </reportSets>
                                </plugin>
                            </reportPlugins>
                        </configuration>
                        <executions>
                            <execution>
                                <id>dependency-check</id>
                                <phase>site</phase>
                                <goals>
                                    <goal>site</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>embedded-jetty</id>
            <activation>
                <property>
                    <name>env.ACTIVATE_EMBEDDED_JETTY</name>
                    <value>true</value>
                </property>
            </activation>
            <build>
                <defaultGoal>package</defaultGoal>
                <plugins>
                    <plugin>
                        <groupId>com.coderplus.maven.plugins</groupId>
                        <artifactId>copy-rename-maven-plugin</artifactId>
                        <version>1.0.1</version>
                        <executions>
                            <execution>
                                <id>copy-and-rename-file</id>
                                <phase>compile</phase>
                                <goals>
                                    <goal>copy</goal>
                                </goals>
                                <configuration>
                                    <sourceFile>${logback.configuration.file}</sourceFile>
                                    <destinationFile>${project.build.directory}/${project.build.finalName}/logback.xml</destinationFile>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-war-plugin</artifactId>
                        <version>${maven.war.plugin.version}</version>
                        <configuration>
                            <warName>${project.build.finalName}-embedded</warName>
                            <archive>
                                <manifest>
                                    <mainClass>alpine.embedded.EmbeddedJettyServer</mainClass>
                                </manifest>
                            </archive>
                            <packagingExcludes>WEB-INF/lib/executable-war-*.jar</packagingExcludes>
                            <dependentWarExcludes>WEB-INF/lib/*log4j*.jar,WEB-INF/lib/*slf4j*.jar</dependentWarExcludes>
                            <overlays>
                                <overlay>
                                    <groupId>us.springett</groupId>
                                    <artifactId>alpine-executable-war</artifactId>
                                    <type>jar</type>
                                </overlay>
                                <overlay>
                                    <groupId>org.owasp</groupId>
                                    <artifactId>security-logging-common</artifactId>
                                    <type>jar</type>
                                </overlay>
                                <overlay>
                                    <groupId>org.owasp</groupId>
                                    <artifactId>security-logging-logback</artifactId>
                                    <type>jar</type>
                                </overlay>
                            </overlays>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>release</id>
            <activation>
                <activeByDefault>false</activeByDefault>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-enforcer-plugin</artifactId>
                        <version>${maven.enforcer.plugin.version}</version>
                        <executions>
                            <execution>
                                <id>enforce-java</id>
                                <goals>
                                    <goal>enforce</goal>
                                </goals>
                                <configuration>
                                    <rules>
                                        <requireJavaVersion>
                                            <version>${maven.compiler.target}</version>
                                        </requireJavaVersion>
                                    </rules>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>${maven.gpg.plugin.version}</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

    </profiles>

</project>