Apache Software Foundation Parent POM

This project consists of a POM that contains settings that are likely to be useful to any Apache project that is building and releasing code with Maven 3 (Maven 2.x is not supported any more since version 17). By using this project as a parent, a project gets these settings.

Most projects will want to override some of these settings.

The following is a list of the items configured in this POM:

• Top-level project properties:
  • license: Apache License, version 2.0.
  • organization: The Apache Software Foundation
  • url: https://www.apache.org/. You should override this.
  • repositories: The pom adds the Apache snapshot repository (https://repository.apache.org/snapshots)
  • distributionManagement: The POM sets up for releases to the Apache Nexus instance at https://repository.apache.org/service/local/staging/deploy/maven2 and snapshots to https://repository.apache.org/content/repositories/snapshots. Note that there are POM parameters (distMgmtSnapshotsName and distMgmtSnapshotsUrl) that you can override to change the snapshot location.
  • mailingLists: The POM sets up generic Apache announcement lists. You should override this.
• pluginManagement: The plugin management section specifies versions of a list of plugins. See the Plugin Management report for the complete list with versions.
  • The compiler plugin is set to default to Java 1.7 and UTF-8 source.
  • The jar plugin is set to add default specification and implementation entries.
  • The resources plugin is set for UTF-8.
  • The release plugin is set, via the <arguments> configuration element, to enable the apache-release profile for all executions and to disable <useReleaseProfiles>. You can remove this with an empty <arguments/> element in the configuration of the release plugin.
• plugins: The plugins section configures two executions:
  • maven-remote-resources-plugin for org.apache:apache-jar-resource-bundle:1.4.
  • maven-site-plugin:attach-descriptor
• Reproducible Builds: since version 22 of this parent POM, managed plugins versions are expected to be compliant with Reproducible Builds.

  To choose the timestamp in output archives, projects using this POM as parent should define a property in their root POM:

    <properties>
      <project.build.outputTimestamp>2019-10-02T08:04:00Z</project.build.outputTimestamp>
    </properties>

  The value will be updated by Maven Release Plugin during releases. If a project wants to disable Reproducible Builds, just define the property value with any single character.

The apache-release Profile

As noted above, this pom configures the release plugin to enable the apache-release profile for all executions of the release plugin.

The profile includes the following plugins:

• maven-assembly-plugin: org.apache.apache.resources:apache-source-release-assembly-descriptor:1.0.6 is added as dependency, and an execution is configured with source-release-assembly id.
  The plugin is configured to take a descriptorRef name from the sourceReleaseAssemblyDescriptor property, which by default is set to source-release (zip only): you can override the property with source-release-zip-tar (both zip and tar) or source-release-tar (tar only) values.
  If you want to avoid this default assembly execution to provide your own mechanism to produce the source release archive, you can disable the execution by configuring skipAssembly parameter for this source-release-assembly execution id
• maven-deploy-plugin: configured to activate updateReleaseInfo
• maven-source-plugin: configured to build and attach a source jar.
• maven-javadoc-plugin: configured to build and attach a javadoc jar.
• maven-gpg-plugin: configured to sign everything. It expects to find a passphrase in ${gpg.passphrase}, presumably in your settings.xml.
• checksum-maven-plugin: configured to create a checksum file(s) for source release as required by Apache release distribution policy.

When doing a release with maven-release-plugin, this creates files in target/checkout/target ready to be copied to projects' Apache /dist/ release distribution directory:

• ${artifactId}-${version}-source-release.[zip|tar.gz]: the source release archive(s)
• ${artifactId}-${version}-source-release.[zip|tar.gz].sha512: their checksum(s)
• ${artifactId}-${version}-source-release.[zip|tar.gz].asc: their signature(s)

Settings Configuration

You can have a look at the page in Apache website Publishing Maven Artifacts.

You can test your environment setup using -Papache-release with the command line.

History