<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.srcclr</groupId>
  <artifactId>srcclr-sdk-java</artifactId>
  <packaging>pom</packaging>
  <version>0.3.62</version>
  <name>SourceClear - Java SDK</name>
  <description>The SRC:CLR Java SDK contains tools for creating Java clients for the SRC:CLR platform.</description>
  <url>https://srcclr.com</url>
  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <gradle.version>5.5.1</gradle.version>
    <jackson.version>2.13.4</jackson.version>
    <maven.version>3.6.3</maven.version>
    <maven.dependency.version>3.0.1</maven.dependency.version>
    <kotlin.version>1.3.70</kotlin.version>
  </properties>

  <dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.fasterxml.jackson</groupId>
            <artifactId>jackson-bom</artifactId>
            <version>${jackson.version}</version>
            <scope>import</scope>
            <type>pom</type>
        </dependency>
    </dependencies>
  </dependencyManagement>

  <developers>
    <developer>
      <name>SRC:CLR Engineering</name>
      <email>engineering@srcclr.com</email>
      <organization>SRC:CLR</organization>
      <organizationUrl>https://srcclr.com</organizationUrl>
    </developer>
  </developers>

  <licenses>
    <license>
      <name>SourceClear Proprietary</name>
      <url>https://srcclr.com</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <scm>
    <connection>scm:git:git@gitlab.laputa.veracode.io:sca/srcclr-sdk-java.git</connection>
    <developerConnection>scm:git:git@gitlab.laputa.veracode.io:sca/srcclr-sdk-java.git</developerConnection>
    <url>https://gitlab.laputa.veracode.io/sca/srcclr-sdk-java</url>
    <tag>srcclr-sdk-java-0.3.62</tag>
  </scm>

  <repositories>
    <!-- Repository for security-logging -->
    <repository>
      <id>LaputaReleases</id>
      <url>https://maven.laputa.veracode.io/api/object/releases</url>
    </repository>
  </repositories>

  <modules>
    <module>srcclr-sdk-install-prerequisites</module>
    <module>srcclr-sdk-core</module>
  </modules>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <version>3.2.1</version>
        <executions>
          <execution>
            <id>attach-sources</id>
            <phase>package</phase>
            <goals>
              <goal>jar-no-fork</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.8.1</version>
        <configuration>
          <source>1.8</source>
          <target>1.8</target>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-release-plugin</artifactId>
        <version>2.5.3</version>
        <executions>
          <execution>
            <goals>
              <goal>prepare</goal>
              <goal>perform</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <version>3.0.0-M3</version>
        <configuration>
          <rules><requireUpperBoundDeps /></rules>
          <fail>true</fail>
        </configuration>
        <executions>
          <execution>
            <id>enforce-upper-bound-deps</id>
            <phase>compile</phase>
            <goals>
              <goal>enforce</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <profiles>

    <profile>
      <id>ci</id>
      <activation>
        <activeByDefault>false</activeByDefault>
        <property>
          <name>env.BUILD_NUMBER</name>
        </property>
      </activation>
      <properties>
        <jacocoUnitTestInfo>${project.build.directory}/coverage-report-artifacts/jacoco-unit.exec</jacocoUnitTestInfo>
        <jacocoUnitTestReport>${project.build.directory}/coverage-reports/jacoco-unit</jacocoUnitTestReport>
        <jacocoIntTestInfo>${project.build.directory}/coverage-report-artifacts/jacoco-it.exec</jacocoIntTestInfo>
        <jacocoIntTestReport>${project.build.directory}/coverage-reports/jacoco-it</jacocoIntTestReport>
      </properties>
      <build>
        <plugins>
          <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <version>0.7.4.201502262128</version>
            <executions>
              <execution>
                <id>pre-unit-test</id>
                <goals>
                  <goal>prepare-agent</goal>
                </goals>
                <configuration>
                  <destFile>${jacocoUnitTestInfo}</destFile>
                  <append>true</append>
                </configuration>
              </execution>
              <execution>
                <id>post-unit-test</id>
                <phase>test</phase>
                <goals>
                  <goal>report</goal>
                </goals>
                <configuration>
                  <dataFile>${jacocoUnitTestInfo}</dataFile>
                  <outputDirectory>${jacocoUnitTestReport}</outputDirectory>
                </configuration>
              </execution>
              <execution>
                <id>pre-integration-test</id>
                <phase>pre-integration-test</phase>
                <goals>
                  <goal>prepare-agent-integration</goal>
                </goals>
                <configuration>
                  <destFile>${jacocoIntTestInfo}</destFile>
                  <propertyName>invoker.mavenOpts</propertyName>
                  <append>true</append>
                </configuration>
              </execution>
              <execution>
                <id>post-integration-test</id>
                <phase>post-integration-test</phase>
                <goals>
                  <goal>report</goal>
                </goals>
                <configuration>
                  <dataFile>${jacocoIntTestInfo}</dataFile>
                  <outputDirectory>${jacocoIntTestReport}</outputDirectory>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>

    <profile>
      <!-- Not to be used unless you know what it does and why you're doing it. -->
      <id>signed-artifacts</id>
      <activation>
        <activeByDefault>false</activeByDefault>
      </activation>
      <properties>
        <!-- this has to be an env to survive the release sub-process -->
        <jarsign.alias>${env.JARSIGN_ALIAS}</jarsign.alias>
        <!-- yes, it quite literally is "NONE" -->
        <jarsign.keystore>NONE</jarsign.keystore>
        <jarsign.storepass>${env.SAFENET_PASSPHRASE}</jarsign.storepass>
        <jarsign.storetype>PKCS11</jarsign.storetype>
        <jarsign.providerClass>sun.security.pkcs11.SunPKCS11</jarsign.providerClass>
        <jarsign.providerArg>${env.WORKSPACE}/pkcs11.conf</jarsign.providerArg>
        <!-- yup, it's actually http; they're not even *listening* on 443 -->
        <jarsign.tsa>http://timestamp.digicert.com</jarsign.tsa>
        <gpg.keyname>${env.GPG_KEYNAME}</gpg.keyname>
      </properties>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-jarsigner-plugin</artifactId>
            <version>1.4</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>package</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
            <configuration>
              <arguments>
                <argument>-certs</argument>
                <argument>-verbose:all</argument>
              </arguments>
              <errorWhenNotSigned>true</errorWhenNotSigned>
              <alias>${jarsign.alias}</alias>
              <keystore>${jarsign.keystore}</keystore>
              <storepass>${jarsign.storepass}</storepass>
              <storetype>${jarsign.storetype}</storetype>
              <providerClass>${jarsign.providerClass}</providerClass>
              <providerArg>${jarsign.providerArg}</providerArg>
              <tsa>${jarsign.tsa}</tsa>
            </configuration>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>1.6</version>
            <executions>
              <execution>
                <id>gpg-sign</id>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
            <configuration>
              <homedir>${env.WORKSPACE}/.gnupg</homedir>
              <detail>true</detail>
              <keyname>${gpg.keyname}</keyname>
              <passphrase>${gpg.passphrase}</passphrase>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
    <!-- Used when deploying a snapshot internally.  This is needed in a profile because we'll be deploying
         to Maven Central and want this as a one-off profile -->
    <profile>
      <id>dev</id>
      <distributionManagement>
        <snapshotRepository>
          <uniqueVersion>false</uniqueVersion>
          <id>sourceclearSnapshots</id>
          <name>SourceClear Snapshots</name>
          <url>https://maven.sourceclear.io/content/repositories/sourceclear-snapshots/</url>
          <layout>default</layout>
        </snapshotRepository>
      </distributionManagement>
    </profile>
    <profile>
      <id>external-deploy</id>
      <distributionManagement>
        <snapshotRepository>
          <id>ossrh</id>
          <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
        <repository>
          <id>ossrh</id>
          <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
        </repository>
      </distributionManagement>
      <build>
        <plugins>
          <plugin>
            <groupId>org.sonatype.plugins</groupId>
            <artifactId>nexus-staging-maven-plugin</artifactId>
            <version>1.6.8</version>
            <extensions>true</extensions>
            <configuration>
              <serverId>ossrh</serverId>
              <nexusUrl>https://oss.sonatype.org/</nexusUrl>
              <autoReleaseAfterClose>true</autoReleaseAfterClose>
            </configuration>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>1.6</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
                <configuration>
                  <keyname>production@srcclr.com</keyname>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
      <activation>
        <activeByDefault>false</activeByDefault>
        <property>
          <name>performRelease</name>
          <value>true</value>
        </property>
      </activation>
    </profile>
  </profiles>
</project>
