When working with surefire, it is necessary to understand a few things:
The plugin is built as part of a multi-module plugin. The generated 'project information' will suggest that you check out (e.g.) http://svn.apache.org/repos/asf/maven/surefire/trunk/maven-surefire-plugin. In fact, you need to check out (e.g.) http://svn.apache.org/repos/asf/maven/surefire/trunk and build from there.
The surefire booter is capable of booting all the way back to jdk1.3. Specifically this means surefire-api, surefire-booter, common-junit3 and surefire-junit3 are source/target 1.3. The plugin itself is 1.4 and several providers are 1.5.
Classes in the SUT (Subject Under Test), override any classes within the surefire providers. This means providers using any third party dependencies (other than the test framework itself), should shade these classes to a different package.
The surefire-providers module contains common-junitXX modules. These modules depend on the XX version of JUnit and can access the JUnit API's at the correct JUnit version level. Unit tests can also be written that will run with the correct JUnit version. At build time, all of the relevant parts of these "common" modules are just shaded into the providers jar files.
"Shadefire" is the first module to be run in the surefire build. This creates as shaded version of the JUnit provider, and this provider is thereafter used to build surefire itself (As of any release after 2.8). This is because the SUT overrides the provider, and the shadefire provider has been relocated to avoid this overriding when surefire is building itself.