Parent POM

Owned by ChadC
Last updated: Sept 07, 2021 by Scott Cantor
2 min read

All the Java-based Shibboleth projects have a POM file that inherits the net.shibboleth:parent:*. This parent POM, found in the java-parent-project project, contains:

  • pegged maven plugin versions

  • a set of dependencies, pegged to a specific version, used by all projects

  • a set of managed dependencies, pegged to a specific version, which may be used by any project

  • deployment targets for snapshot and release releases

  • definitions for the release and sign profiles

  • definition for project reports

  • project metadata (website, mailing list info, links to subversion server, etc.)

The result of this is that each project's metadata is significantly shorter and only contains project-specific information. Otherwise each project's POM would be around 1,000 lines long which would be a total pain to maintain.

Managed Dependencies

As mentioned above, the parent POM contains definitions for managed dependencies. These are dependencies that are defined within the parent POM but are not automatically available to projects which inherit from the parent POM. This allows us to peg the version, scope, and exclusions of the dependency across all the projects that use the dependency.

To use a managed dependency within a project, you define it like you normally would except you leave off the version. So, for example, to declare a dependncy on the Servlet API within your project you would add the following:

<dependency> <groupId>javax.servlet</groupId> <artifactId>javax.servlet-api</artifactId> </dependency>

The fact that the version we use is 3.1.0 and that this artifact has a scope of provided will be inherited from the parent POM.

Build Profiles

The parent POM defines two profiles.

The release profile includes:

  • The assembly plugin. Child projects should declare this plugin (sans version) and define in its configuration the assembly descriptor file.

  • The compiler plugin with the appropriate configuration to show deprecation and compiler warnings, and include debug symbols.

  • The dependency plugin which sets up the endorsed directory used during compilation and testing.

  • The jar plugin in order to generate JAR files for our testing code

  • The javadoc plugin in order to generate Javadoc JAR files for our main and testing code. Links to all the javadoc for all dependencies and managed dependencies declared within the parent POM are included in this plugin's configuration. Project inheriting from the parent POM should define this plugin, sans version, and declare links to any javadocs for any additional dependencies declared within the project.

  • The source plugin in order to attach a source JAR to the project

  • The surefire plugin in order to increase the amount of memory it can use (512MB) and to endorse Xerces/Xalan

The sign profile includes:

  • The GPG plugin used to sign all the artifacts