pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         child.project.url.inherit.append.path="false"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.easyssf</groupId>
    <artifactId>easyssf-parent</artifactId>
    <version>0.8.0-SNAPSHOT</version>
    <packaging>pom</packaging>
    <name>easyssf</name>
    <description>Building blocks for the OpenID Shared Signals Framework (SSF)</description>
    <url>https://easyssf.org</url>
    <inceptionYear>2026</inceptionYear>
    <organization>
        <name>easyssf</name>
        <url>https://easyssf.org</url>
    </organization>

    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
        </license>
    </licenses>
    <developers>
        <developer>
            <id>thomasdarimont</id>
            <name>Thomas Darimont</name>
            <email>oss@easyssf.org</email>
            <url>https://github.com/thomasdarimont</url>
            <organization>easyssf</organization>
            <organizationUrl>https://easyssf.org</organizationUrl>
        </developer>
    </developers>
    <scm>
        <url>https://github.com/easyssf/easyssf</url>
        <connection>scm:git:https://github.com/easyssf/easyssf.git</connection>
        <developerConnection>scm:git:git@github.com:easyssf/easyssf.git</developerConnection>
        <tag>HEAD</tag>
    </scm>
    <issueManagement>
        <system>GitHub</system>
        <url>https://github.com/easyssf/easyssf/issues</url>
    </issueManagement>

    <modules>
        <module>easyssf-core</module>
        <module>easyssf-test</module>
        <module>easyssf-receiver</module>
        <module>easyssf-receiver-jdbc</module>
        <module>easyssf-test-conformance</module>
        <module>easyssf-receiver-spring-boot-autoconfigure</module>
        <module>easyssf-receiver-spring-boot-starter</module>
        <module>easyssf-receiver-spring-boot-examples</module>
        <module>easyssf-receiver-spring-boot-conformance-tests</module>
    </modules>

    <properties>
        <java.version>21</java.version>
        <!-- what the "ide" profile below opens for JUnit; the explicit modules list their test packages -->
        <ide.test.add-opens></ide.test.add-opens>
        <maven.compiler.release>${java.version}</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <!-- lets Byte Buddy (Mockito) accept a class file version it does not know yet, for tests on
             the newest JDK: -Dbytebuddy.experimental=true -->
        <bytebuddy.experimental>false</bytebuddy.experimental>
        <!-- reproducible builds: the timestamp of the files in the jars, updated for every release -->
        <project.build.outputTimestamp>2026-10-30T13:41:19Z</project.build.outputTimestamp>

        <!-- All modules build against the versions of the Spring Boot BOM, imported below.
             The plain modules (easyssf-core, easyssf-receiver) do not depend on Spring:
             the import only resolves versions. -->
        <spring-boot.version>4.1.2</spring-boot.version>
        <!-- not managed by the Spring Boot BOM, Spring Security pulls it in transitively -->
        <nimbus-jose-jwt.version>10.9.1</nimbus-jose-jwt.version>

        <maven-compiler-plugin.version>3.16.0</maven-compiler-plugin.version>
        <maven-surefire-plugin.version>3.6.1</maven-surefire-plugin.version>
        <maven-jar-plugin.version>3.5.1</maven-jar-plugin.version>
        <maven-resources-plugin.version>3.5.0</maven-resources-plugin.version>
        <maven-install-plugin.version>3.2.0</maven-install-plugin.version>
        <maven-deploy-plugin.version>3.2.0</maven-deploy-plugin.version>
        <maven-dependency-plugin.version>3.11.0</maven-dependency-plugin.version>
        <spotless-maven-plugin.version>3.10.4</spotless-maven-plugin.version>
        <flatten-maven-plugin.version>1.8.0</flatten-maven-plugin.version>
        <cyclonedx-maven-plugin.version>2.9.3</cyclonedx-maven-plugin.version>
        <!-- the release profile, see below -->
        <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
        <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
        <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
        <central-publishing-maven-plugin.version>0.12.0</central-publishing-maven-plugin.version>
        <!-- modules that are built but not published set this to true -->
        <maven.deploy.skip>false</maven.deploy.skip>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.easyssf</groupId>
                <artifactId>easyssf-core</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.easyssf</groupId>
                <artifactId>easyssf-receiver</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.easyssf</groupId>
                <artifactId>easyssf-test</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.easyssf</groupId>
                <artifactId>easyssf-receiver-jdbc</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.easyssf</groupId>
                <artifactId>easyssf-test-conformance</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.easyssf</groupId>
                <artifactId>easyssf-receiver-spring-boot-autoconfigure</artifactId>
                <version>${project.version}</version>
            </dependency>
            <dependency>
                <groupId>org.easyssf</groupId>
                <artifactId>easyssf-receiver-spring-boot-starter</artifactId>
                <version>${project.version}</version>
            </dependency>

            <!-- declared before the BOM import so that it takes precedence -->
            <dependency>
                <groupId>com.nimbusds</groupId>
                <artifactId>nimbus-jose-jwt</artifactId>
                <version>${nimbus-jose-jwt.version}</version>
            </dependency>

            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <resources>
            <resource>
                <directory>${project.basedir}/src/main/resources</directory>
            </resource>
            <!-- the licence travels with the code -->
            <resource>
                <directory>${maven.multiModuleProjectDirectory}</directory>
                <targetPath>META-INF</targetPath>
                <includes>
                    <include>LICENSE</include>
                    <include>NOTICE</include>
                </includes>
            </resource>
        </resources>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>${maven-compiler-plugin.version}</version>
                    <configuration>
                        <parameters>true</parameters>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>${maven-surefire-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>${maven-jar-plugin.version}</version>
                    <configuration>
                        <archive>
                            <manifestEntries>
                                <!-- every module sets automatic.module.name -->
                                <Automatic-Module-Name>${automatic.module.name}</Automatic-Module-Name>
                            </manifestEntries>
                        </archive>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-resources-plugin</artifactId>
                    <version>${maven-resources-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-install-plugin</artifactId>
                    <version>${maven-install-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>${maven-deploy-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>${maven-dependency-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                    <version>${spring-boot.version}</version>
                    <executions>
                        <execution>
                            <id>repackage</id>
                            <goals>
                                <goal>repackage</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <!-- The published POMs are self-contained: no parent, no imported BOM, every
                         version resolved. Consumers do not see the build structure. -->
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>flatten-maven-plugin</artifactId>
                    <version>${flatten-maven-plugin.version}</version>
                    <configuration>
                        <flattenMode>oss</flattenMode>
                        <updatePomFile>true</updatePomFile>
                    </configuration>
                    <executions>
                        <execution>
                            <id>flatten</id>
                            <phase>process-resources</phase>
                            <goals>
                                <goal>flatten</goal>
                            </goals>
                        </execution>
                        <execution>
                            <id>flatten-clean</id>
                            <phase>clean</phase>
                            <goals>
                                <goal>clean</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <!-- a CycloneDX SBOM (target/bom.json) for every module, attached to the artifact -->
                    <groupId>org.cyclonedx</groupId>
                    <artifactId>cyclonedx-maven-plugin</artifactId>
                    <version>${cyclonedx-maven-plugin.version}</version>
                    <configuration>
                        <outputFormat>json</outputFormat>
                        <projectType>library</projectType>
                        <includeTestScope>false</includeTestScope>
                    </configuration>
                    <executions>
                        <execution>
                            <id>sbom</id>
                            <phase>package</phase>
                            <goals>
                                <goal>makeBom</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-source-plugin</artifactId>
                    <version>${maven-source-plugin.version}</version>
                    <executions>
                        <execution>
                            <id>attach-sources</id>
                            <goals>
                                <goal>jar-no-fork</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>${maven-javadoc-plugin.version}</version>
                    <configuration>
                        <!-- a missing comment is not an error, a broken one is -->
                        <doclint>all,-missing</doclint>
                        <quiet>true</quiet>
                    </configuration>
                    <executions>
                        <execution>
                            <id>attach-javadocs</id>
                            <goals>
                                <goal>jar</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <!-- Signs every artifact with the project key. The passphrase comes from the
                         environment variable MAVEN_GPG_PASSPHRASE, never from the command line. -->
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-gpg-plugin</artifactId>
                    <version>${maven-gpg-plugin.version}</version>
                    <configuration>
                        <bestPractices>true</bestPractices>
                        <gpgArguments>
                            <arg>--pinentry-mode</arg>
                            <arg>loopback</arg>
                        </gpgArguments>
                    </configuration>
                    <executions>
                        <execution>
                            <id>sign-artifacts</id>
                            <phase>verify</phase>
                            <goals>
                                <goal>sign</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
                <plugin>
                    <!-- Uploads the whole reactor as one deployment to the Maven Central portal
                         (credentials: server "central" in settings.xml) and waits until it is
                         published. Snapshots go to the Central snapshot repository instead. -->
                    <groupId>org.sonatype.central</groupId>
                    <artifactId>central-publishing-maven-plugin</artifactId>
                    <version>${central-publishing-maven-plugin.version}</version>
                    <extensions>true</extensions>
                    <configuration>
                        <publishingServerId>central</publishingServerId>
                        <deploymentName>easyssf ${project.version}</deploymentName>
                        <autoPublish>true</autoPublish>
                        <waitUntil>published</waitUntil>
                        <skipPublishing>${maven.deploy.skip}</skipPublishing>
                        <excludeArtifacts>
                            <!-- the flattened POMs of the modules do not reference the parent -->
                            <excludeArtifact>easyssf-parent</excludeArtifact>
                        </excludeArtifacts>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>com.diffplug.spotless</groupId>
                    <artifactId>spotless-maven-plugin</artifactId>
                    <version>${spotless-maven-plugin.version}</version>
                    <configuration>
                        <java>
                            <importOrder>
                                <order>java|javax|jakarta,org,com,,\#</order>
                            </importOrder>
                            <removeUnusedImports/>
                            <eclipse>
                                <!-- the Spring Java Format conventions, see the file -->
                                <file>${maven.multiModuleProjectDirectory}/etc/eclipse-formatter.prefs</file>
                            </eclipse>
                            <trimTrailingWhitespace/>
                            <endWithNewline/>
                        </java>
                    </configuration>
                    <executions>
                        <execution>
                            <id>check</id>
                            <goals>
                                <goal>check</goal>
                            </goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>
        <plugins>
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>flatten-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <!-- the flattened POMs of the modules do not reference this parent, it is not published -->
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-deploy-plugin</artifactId>
                <inherited>false</inherited>
                <configuration>
                    <skip>true</skip>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <!-- Active in IntelliJ IDEA only, which sets idea.version: the IDE runs the tests of an explicit
                 module with JUnit on the module path, where surefire keeps JUnit on the class path, so the IDE
                 needs the test packages opened to the JUnit module. It copies surefire's argLine into its
                 JUnit run configurations; each explicit module lists its test packages in ide.test.add-opens.
                 Under Maven the profile is off and the option, whose target module is unknown there, is not
                 passed. See CONTRIBUTING.md. -->
            <id>ide</id>
            <activation>
                <property>
                    <name>idea.version</name>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-surefire-plugin</artifactId>
                        <configuration>
                            <argLine>${ide.test.add-opens}</argLine>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <!-- A javadoc comment that is attached to nothing, typically one that a later edit separated from
                 its method, is an error. javac knows the lint from JDK 23 on, so the check runs where the build
                 JDK is new enough: the "jdk" job of the CI, not the Java 21 jobs. See CONTRIBUTING.md. -->
            <id>dangling-doc-comments</id>
            <activation>
                <jdk>[23,)</jdk>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <configuration>
                            <compilerArgs>
                                <arg>-Xlint:dangling-doc-comments</arg>
                                <arg>-Werror</arg>
                            </compilerArgs>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <!-- Builds the artifacts the way Maven Central requires them: sources and javadoc jars,
                 GPG signatures, and "deploy" publishes to the Central portal. See CONTRIBUTING.md. -->
            <id>release</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                    </plugin>
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

</project>