Skip to content

Commit 3f2e3a2

Browse files
goneallgoneall
authored
Merge pull request #56 from spdx/releasepom
Update POM file for release
2 parents 6722f8d + e07ae7b commit 3f2e3a2

File tree

3 files changed

+133
-41
lines changed

3 files changed

+133
-41
lines changed

‎RELEASE-CHECKLIST.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Release Checklist for the SPDX RDF Store
2+
3+
- [ ] Check for any warnings from the compiler and findbugs
4+
- [ ] Run unit tests for all packages that depend on the library
5+
- [ ] Run dependency check to find any potential vulnerabilities `mvn dependency-check:check`
6+
- [ ] Test the release `mvn release:prepare -DdryRun`
7+
- [ ] Run `mvn release:prepare` - you will be prompted for the release - typically take the defaults
8+
- [ ] Run `mvn release:perform`
9+
- [ ] Release artifacts to Maven Central
10+
- [ ] Create a Git release including release notes
11+
- [ ] Zip up the files from the Maven archive and add them to the release

‎dependency-check-supress.xml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
<suppress>
4+
<notes><![CDATA[
5+
file name: jackson-core-2.15.3.jar
6+
Since the JSON input files are generated, this vulnerability can not occur
7+
]]></notes>
8+
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@.*$</packageUrl>
9+
<cve>CVE-2023-5072</cve>
10+
</suppress>
11+
<suppress>
12+
<notes><![CDATA[
13+
file name: jackson-core-2.15.3.jar
14+
Since the JSON input files are generated, this vulnerability can not occur
15+
]]></notes>
16+
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@.*$</packageUrl>
17+
<cve>CVE-2023-5072</cve>
18+
</suppress>
19+
<suppress>
20+
<notes><![CDATA[
21+
file name: jackson-databind-2.15.3.jar
22+
he vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.
23+
]]></notes>
24+
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
25+
<cve>CVE-2023-35116</cve>
26+
</suppress>
27+
<suppress>
28+
<notes><![CDATA[
29+
file name: jakarta.json-2.0.1.jar
30+
Since the JSON input files are generated, this vulnerability can not occur
31+
]]></notes>
32+
<packageUrl regex="true">^pkg:maven/org\.glassfish/jakarta\.json@.*$</packageUrl>
33+
<cve>CVE-2022-45688</cve>
34+
</suppress>
35+
<suppress>
36+
<notes><![CDATA[
37+
file name: jakarta.json-2.0.1.jar
38+
Since the JSON input files are generated, this vulnerability can not occur
39+
]]></notes>
40+
<packageUrl regex="true">^pkg:maven/org\.glassfish/jakarta\.json@.*$</packageUrl>
41+
<cve>CVE-2023-5072</cve>
42+
</suppress>
43+
<suppress>
44+
<notes><![CDATA[
45+
file name: jsonld-java-0.13.4.jar
46+
Since the JSON input files are generated, this vulnerability can not occur
47+
]]></notes>
48+
<packageUrl regex="true">^pkg:maven/com\.github\.jsonld\-java/jsonld\-java@.*$</packageUrl>
49+
<cve>CVE-2022-45688</cve>
50+
</suppress>
51+
<suppress>
52+
<notes><![CDATA[
53+
file name: jackson-core-2.15.3.jar
54+
Since the JSON input files are generated, this vulnerability can not occur
55+
]]></notes>
56+
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@.*$</packageUrl>
57+
<cve>CVE-2022-45688</cve>
58+
</suppress>
59+
<suppress>
60+
<notes><![CDATA[
61+
file name: jsonld-java-0.13.4.jar
62+
Since the JSON input files are generated, this vulnerability can not occur
63+
]]></notes>
64+
<packageUrl regex="true">^pkg:maven/com\.github\.jsonld\-java/jsonld\-java@.*$</packageUrl>
65+
<cve>CVE-2023-5072</cve>
66+
</suppress>
67+
</suppressions>

‎pom.xml‎

Lines changed: 55 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949

5050
<profiles>
5151
<profile>
52-
<id>gpg-signing</id>
52+
<id>release</id>
5353
<build>
5454
<plugins>
5555
<plugin>
@@ -70,6 +70,42 @@
7070
</execution>
7171
</executions>
7272
</plugin>
73+
<plugin>
74+
<groupId>org.apache.maven.plugins</groupId>
75+
<artifactId>maven-javadoc-plugin</artifactId>
76+
<version>2.9</version>
77+
<configuration>
78+
<quiet>true</quiet>
79+
<source>8</source>
80+
<javadocExecutable>${env.JAVA_HOME}/bin/javadoc</javadocExecutable>
81+
<additionalparam>-Xdoclint:none</additionalparam>
82+
</configuration>
83+
<executions>
84+
<execution>
85+
<id>attach-javadocs</id>
86+
<configuration>
87+
<additionalparam>${javadoc.opts}</additionalparam>
88+
</configuration>
89+
<goals>
90+
<goal>jar</goal>
91+
</goals>
92+
</execution>
93+
</executions>
94+
</plugin>
95+
<plugin>
96+
<groupId>org.apache.maven.plugins</groupId>
97+
<artifactId>maven-source-plugin</artifactId>
98+
<version>3.2.1</version>
99+
<executions>
100+
<execution>
101+
<id>attach-sources</id>
102+
<phase>verify</phase>
103+
<goals>
104+
<goal>jar-no-fork</goal>
105+
</goals>
106+
</execution>
107+
</executions>
108+
</plugin>
73109
</plugins>
74110
</build>
75111
</profile>
@@ -89,17 +125,17 @@
89125
<dependency>
90126
<groupId>org.apache.jena</groupId>
91127
<artifactId>jena-core</artifactId>
92-
<version>4.8.0</version>
128+
<version>4.10.0</version>
93129
</dependency>
94130
<dependency>
95131
<groupId>org.apache.jena</groupId>
96132
<artifactId>jena-arq</artifactId>
97-
<version>4.8.0</version>
133+
<version>4.10.0</version>
98134
</dependency>
99135
<dependency>
100136
<groupId>org.apache.jena</groupId>
101137
<artifactId>jena-base</artifactId>
102-
<version>4.8.0</version>
138+
<version>4.10.0</version>
103139
</dependency>
104140
</dependencies>
105141
<build>
@@ -143,15 +179,28 @@
143179
</testResource>
144180
</testResources>
145181
<plugins>
182+
<plugin>
183+
<groupId>org.apache.maven.plugins</groupId>
184+
<artifactId>maven-release-plugin</artifactId>
185+
<version>3.0.1</version>
186+
<configuration>
187+
<tagNameFormat>v@{project.version}</tagNameFormat>
188+
<releaseProfiles>release</releaseProfiles>
189+
<goals>deploy</goals>
190+
</configuration>
191+
</plugin>
146192
<plugin>
147193
<groupId>org.owasp</groupId>
148194
<artifactId>dependency-check-maven</artifactId>
149195
<version>${dependency-check-maven.version}</version>
196+
<configuration>
197+
<suppressionFiles>dependency-check-supress.xml</suppressionFiles>
198+
</configuration>
150199
</plugin>
151200
<plugin>
152201
<groupId>org.apache.maven.plugins</groupId>
153202
<artifactId>maven-compiler-plugin</artifactId>
154-
<version>3.6.1</version>
203+
<version>3.11.0</version>
155204
<configuration>
156205
<release>11</release>
157206
<encoding>${project.build.sourceEncoding}</encoding>
@@ -160,42 +209,6 @@
160209
<optimize>true</optimize>
161210
</configuration>
162211
</plugin>
163-
<plugin>
164-
<groupId>org.apache.maven.plugins</groupId>
165-
<artifactId>maven-javadoc-plugin</artifactId>
166-
<version>2.9</version>
167-
<configuration>
168-
<quiet>true</quiet>
169-
<source>8</source>
170-
<javadocExecutable>${env.JAVA_HOME}/bin/javadoc</javadocExecutable>
171-
<additionalparam>-Xdoclint:none</additionalparam>
172-
</configuration>
173-
<executions>
174-
<execution>
175-
<id>attach-javadocs</id>
176-
<configuration>
177-
<additionalparam>${javadoc.opts}</additionalparam>
178-
</configuration>
179-
<goals>
180-
<goal>jar</goal>
181-
</goals>
182-
</execution>
183-
</executions>
184-
</plugin>
185-
<plugin>
186-
<groupId>org.apache.maven.plugins</groupId>
187-
<artifactId>maven-source-plugin</artifactId>
188-
<version>3.2.1</version>
189-
<executions>
190-
<execution>
191-
<id>attach-sources</id>
192-
<phase>verify</phase>
193-
<goals>
194-
<goal>jar-no-fork</goal>
195-
</goals>
196-
</execution>
197-
</executions>
198-
</plugin>
199212
<plugin>
200213
<groupId>org.spdx</groupId>
201214
<artifactId>spdx-maven-plugin</artifactId>
@@ -253,6 +266,7 @@
253266
<url>https://github.com/spdx/spdx-java-rdf-store</url>
254267
<connection>scm:git:git://github.com/spdx/spdx-java-rdf-store</connection>
255268
<developerConnection>scm:git:[email protected]:/spdx/spdx-java-rdf-store</developerConnection>
269+
<tag>master</tag>
256270
</scm>
257271
<issueManagement>
258272
<system>Github</system>

0 commit comments

Comments
 (0)