pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://maven.apache.org/POM/4.0.0"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>net.perseity</groupId>
    <artifactId>java-crypt</artifactId>
    <version>0.1.0-SNAPSHOT</version>

    <name>java-crypt</name>
    <description>A Java library for cryptographic operations.</description>
    <url>https://github.com/paulowoody/java-crypt</url>

    <licenses>
        <license>
            <name>MIT License</name>
            <url>https://opensource.org/licenses/MIT</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <scm>
        <url>https://github.com/paulowoody/java-crypt</url>
        <connection>scm:git:git://github.com/paulowoody/java-crypt.git</connection>
        <developerConnection>scm:git:ssh://github.com:paulowoody/java-crypt.git</developerConnection>
    </scm>

    <properties>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <build>
        <plugins>
            <!-- 1. Maven Clean Plugin: Customizes the 'mvn clean' process.
                 In this project, we use it to delete temporary files generated by the Demo (keys, certs, emails) 
                 that are saved in the project root rather than the target folder. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.3.2</version>
                <configuration>
                    <filesets>
                        <fileset>
                            <directory>.</directory>
                            <includes>
                                <include>*.pem</include>
                                <include>*.pub</include>
                                <include>*.key</include>
                                <include>*.eml</include>
                                <include>*.log</include>
                            </includes>
                            <followSymlinks>false</followSymlinks>
                        </fileset>
                    </filesets>
                </configuration>
            </plugin>

            <!-- 2. Maven Source Plugin: Packages the library source code into a -sources.jar.
                 This is essential for IDEs to provide "Go to Definition" and debugging support for consumers. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>3.3.1</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar-no-fork</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- 3. Maven Javadoc Plugin: Generates API documentation from code comments.
                 Visibility is set to 'protected' to document the public API while hiding internal implementation details.
                 The 'additionalOption' is required because Javadoc needs access to the same internal sun.security 
                 packages used by the library itself. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.6.3</version>
                <configuration>
                    <show>protected</show>
                    <nohelp>true</nohelp>
                    <additionalOptions>
                        <additionalOption>--add-exports java.base/sun.security.x509=ALL-UNNAMED</additionalOption>
                    </additionalOptions>
                </configuration>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- 4. Maven Compiler Plugin: Configures the Java compiler.
                 CRITICAL: We must use '-source' and '-target' instead of 'release' because 'release' 
                 strictly prevents access to internal JVM APIs (sun.security.x509) which we use 
                 for native TLS certificate generation. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.12.1</version>
                <configuration>
                    <source>21</source>
                    <target>21</target>
                    <compilerArgs>
                        <arg>-proc:none</arg>
                        <arg>-Xlint:all</arg>
                        <arg>-Xlint:-options</arg> <!-- Suppress warnings about using source/target without release -->
                        <arg>--add-exports=java.base/sun.security.x509=ALL-UNNAMED</arg>
                    </compilerArgs>
                </configuration>
            </plugin>

            <!-- 5. Maven Surefire Plugin: Runs Unit Tests.
                 We pass the same 'add-exports' flag to the JVM running the tests so MyTLSCert works in test mode. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.2.5</version>
                <configuration>
                    <argLine>@{argLine} --add-exports java.base/sun.security.x509=ALL-UNNAMED</argLine>
                </configuration>
            </plugin>

            <!-- 6. Maven Assembly Plugin: Creates a "Fat JAR" containing all dependencies.
                 This allows the library/demo to be run as a standalone executable via 'java -jar'.
                 The manifest entries ensure that when the JAR is run, it correctly declares its 
                 requirement for internal module access. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-assembly-plugin</artifactId>
                <version>3.7.1</version>
                <executions>
                    <execution>
                        <id>make-assembly</id>
                        <phase>package</phase>
                        <goals>
                            <goal>single</goal>
                        </goals>
                        <configuration>
                            <attach>false</attach>
                            <appendAssemblyId>true</appendAssemblyId>
                            <archive>
                                <manifest>
                                    <mainClass>net.perseity.Demo</mainClass>
                                </manifest>
                                <manifestEntries>
                                    <Add-Exports>java.base/sun.security.x509</Add-Exports>
                                    <Multi-Release>true</Multi-Release>
                                </manifestEntries>
                            </archive>
                            <descriptors>
                                <descriptor>src/main/assembly/assembly.xml</descriptor>
                            </descriptors>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- 7. Versions Maven Plugin: Helps manage and update dependency versions. -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>
                <version>2.17.1</version>
            </plugin>

            <!-- 8. Maven Jar Plugin: Configures the standard library JAR. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.4.2</version>
            </plugin>

            <!-- 9. JaCoCo Maven Plugin: Measures and reports code coverage for tests. -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>0.8.13</version>
                <configuration>
                    <excludes>
                        <exclude>net/perseity/Demo.class</exclude>
                    </excludes>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>check</id>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <rule>
                                    <element>BUNDLE</element>
                                    <limits>
                                        <limit>
                                            <counter>INSTRUCTION</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>0.80</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- 10. CycloneDX Maven Plugin: Generates a Software Bill of Materials (SBOM).
                  Standard for security audits and tracking third-party dependencies. -->
            <plugin>
                <groupId>org.cyclonedx</groupId>
                <artifactId>cyclonedx-maven-plugin</artifactId>
                <version>2.7.9</version>
                <configuration>
                    <schemaVersion>1.4</schemaVersion>
                    <outputFormat>all</outputFormat>
                    <includeCompileScope>true</includeCompileScope>
                    <includeProvidedScope>false</includeProvidedScope>
                    <includeRuntimeScope>true</includeRuntimeScope>
                    <includeTestScope>false</includeTestScope>
                    <includeSystemScope>false</includeSystemScope>
                    <includeLicenseText>true</includeLicenseText>
                    <includeBomSerialNumber>true</includeBomSerialNumber>
                </configuration>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>makeAggregateBom</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- 11. Exec Maven Plugin: Allows running the Demo directly from Maven.
                  - default configuration: runs net.perseity.Demo with required JVM exports.
                  - coverage-summary: uses 'awk' to print a nice coverage percentage in the logs.
                  
                  NOTE: We use combine.self="override" in the executions below to prevent them from 
                  incorrectly inheriting the Java-specific arguments (like add-exports) defined 
                  in the default configuration above. This ensures non-Java tools like 'awk' 
                  receive only their intended parameters. -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <version>3.1.0</version>
                <configuration>
                    <executable>java</executable>
                    <arguments>
                        <argument>--add-exports</argument>
                        <argument>java.base/sun.security.x509=ALL-UNNAMED</argument>
                        <argument>-classpath</argument>
                        <classpath/>
                        <argument>net.perseity.Demo</argument>
                    </arguments>
                </configuration>
            </plugin>

            <!-- 12. OWASP Maven Plugin: Runs dependency security scan from Maven. 
                 Bound to the 'verify' phase to ensure it blocks the build before 
                 installation or deployment if high-severity vulnerabilities (CVSS >= 7.0) are found. -->
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>12.1.3</version>
                <configuration>
                    <nvdApiKey>${nvd.api.key}</nvdApiKey>
                    <failBuildOnCVSS>7.0</failBuildOnCVSS>
                    <formats>
                        <format>HTML</format>
                        <format>JSON</format>
                    </formats>
                    <ossindexAnalyzerEnabled>false</ossindexAnalyzerEnabled>
                </configuration>
                <executions>
                    <execution>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

        </plugins>
    </build>

    <dependencyManagement>
        <!-- Security Overrides: Explicitly manage dependency versions.
             - Plexus versions to mitigate Path Traversal and Zip-Slip vulnerabilities (e.g.,
               CVE-2023-37460) found in transitive dependencies from older Maven plugins -->
        <dependencies>
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-archiver</artifactId>
                <version>4.10.0</version>
            </dependency>
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-utils</artifactId>
                <version>4.0.2</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- Log4j2 for structured logging -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.25.3</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.25.4</version>
        </dependency>
        <!-- JUnit 5 for testing -->
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>5.10.2</version>
            <scope>test</scope>
        </dependency>
        <!-- Jackson for JWT (JSON) handling -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.18.6</version>
        </dependency>
        <!-- Java Mail for Secure Email (MIME) demonstration -->
        <dependency>
            <groupId>com.sun.mail</groupId>
            <artifactId>javax.mail</artifactId>
            <version>1.6.2</version>
        </dependency>
    </dependencies>

    <!-- Project-specific Cloudsmith Maven repository for library distribution -->
    <distributionManagement>
        <repository>
            <id>cloudsmith-deploy</id>
            <url>https://maven.cloudsmith.io/paulowoody/java-crypt/maven/</url>
        </repository>
        <snapshotRepository>
            <id>cloudsmith-deploy</id>
            <url>https://maven.cloudsmith.io/paulowoody/java-crypt/maven/</url>
        </snapshotRepository>
    </distributionManagement>

</project>