Apache Software Foundation Parent POM

This project consists of a POM that contains settings that are likely to be useful to any Apache project that is building and releasing code with Maven. By using this project as a parent, a project gets these settings.

Most projects will want to override some of these settings.

The following is a list of the items configured in this POM:

Top-level project properties:
- license: Apache-2.0.
- organization: The Apache Software Foundation
- url: https://www.apache.org/. You should override this.
- repositories: Optional: the pom adds the Apache snapshot repository (https://repository.apache.org/snapshots). This only happens if the apache.snapshots property is set (set via CLI), or the use-apache-snapshots profile is active.
- distributionManagement: The POM sets up for releases to the Apache Nexus instance at https://repository.apache.org/service/local/staging/deploy/maven2 and snapshots to https://repository.apache.org/content/repositories/snapshots.
  Note that there are distMgmt(Releases|Snapshots)(Name|Url) POM properties (distMgmtReleasesName, distMgmtReleasesUrl, distMgmtSnapshotsName and distMgmtSnapshotsUrl) that you can override to change the names and locations.
- mailingLists: The POM sets up generic Apache announcement lists. You should override this.
- javaVersion: Java version used for compilation, default value is 8.
  You can override this property in your project POM to set different Java version for compilation.
  
  The javaVersion property is used to set the maven.compiler.* properties, so they should not be set directly in your project POM.
  
  They will be set automatically according to the JDK used for the project build:
  - for JDK 8 and older
```
  <maven.compiler.source>${javaVersion}</maven.compiler.source>
  <maven.compiler.target>${javaVersion}</maven.compiler.target>
```
  - for JDK 9 and newer
```
  <maven.compiler.release>${javaVersion}</maven.compiler.release>
```
pluginManagement: The plugin management section specifies versions of a list of plugins. See the Plugin Management report for the complete list with versions.
- There are used properties version.<artifactId> for defining each version of plugin, except:
  - version.apache-resource-bundles is used for: apache-jar-resource-bundle and apache-source-release-assembly-descriptor
  - version.maven-plugin-tools is used for: maven-plugin-annotations, maven-plugin-plugin and maven-plugin-report-plugin
  - version.maven-surefire is used for: maven-failsafe-plugin, maven-surefire-plugin and maven-surefire-report-plugin
- The jar plugin is set to add default specification and implementation entries.
- The resources plugin is set for UTF-8.
- The release plugin is set, via the
  - <releaseProfiles> configuration element, to enable the apache-release profile during release:perform execution
  - enable <autoVersionSubmodules>
plugins: The plugins section configures three executions:
- maven-remote-resources-plugin for org.apache.apache.resources:apache-jar-resource-bundle:1.7.
  - The value of apache-jar-resource-bundle is defined in a property called resourceBundleArtifact. Using the default value for this property will create a Apache JAR Resource Bundle
  - Changing the property value to apache-jar-txt-resource-bundle will create a Apache JAR (.txt) Resource Bundle instead
- maven-enforcer-plugin to check Maven and Java build prerequisites, configured via properties:
  - minimalMavenBuildVersion property: default value is Maven 3.9
  - minimalJavaBuildVersion property: default is javaVersion property value.
Reproducible Builds: since version 22 of this parent POM, managed plugins versions are expected to be compliant with Reproducible Builds.
To choose their own release timestamp in output archives, projects using this POM as parent should override with a property in their root POM:
```
  <properties>
    <project.build.outputTimestamp>10</project.build.outputTimestamp>
  </properties>
```
The value will be updated by Maven Release Plugin during releases. If a project wants to disable Reproducible Builds, just define the property value with any single non-numeric character.

The `apache-release` Profile

As noted above, this pom configures the release plugin to enable the apache-release profile for all executions of the release plugin.

The profile includes the following plugins:

maven-assembly-plugin
org.apache.apache.resources:apache-source-release-assembly-descriptor:1.7 is added as dependency, and an execution is configured with source-release-assembly id.
The plugin is configured to take a descriptorRef name from the sourceReleaseAssemblyDescriptor property, which by default is set to source-release (zip only): you can override the property with source-release-zip-tar (both zip and tar) or source-release-tar (tar only) values.
If you want to avoid this default assembly execution to provide your own mechanism to produce the source release archive, you can disable the execution by configuring skipAssembly parameter for this source-release-assembly execution id
maven-source-plugin
Configured to build and attach a source jar.
maven-javadoc-plugin
Configured to build and attach a javadoc jar.
maven-gpg-plugin
Configured to sign everything.

On developer workstations it expects GnuPG agent to be available to get passphrases, while on fully unattended (CI-like) workflows the use of MAVEN_GPG_PASSPHRASE environment variable use is recommended.
checksum-maven-plugin
Configured to create a checksum file(s) for source release as required by Apache release distribution policy.

When doing a release with maven-release-plugin, this creates files in target/checkout/target ready to be copied to projects' Apache /dist/ release distribution directory:

${artifactId}-${version}-source-release.[zip|tar.gz]: the source release archive(s)
${artifactId}-${version}-source-release.[zip|tar.gz].sha512: their checksum(s)
${artifactId}-${version}-source-release.[zip|tar.gz].asc: their signature(s)

Those files also end up in the staging repository and Maven Central.

Settings Configuration

You can have a look at the page in Apache website Publishing Maven Artifacts.

You can test your environment setup using -Papache-release with the command line.

Notices

Since version 36, the javaVersion property has been introduced to define the Java version used for the maven.compiler.* properties.

Since version 32 maven-site-plugin:attach-descriptor was removed from plugins section.

Publishing a site descriptor is only needed in project parent poms, child projects not need publish it.

When you need publish site descriptor in your project you should add, like:

<build>
  <plugins>
    <plugin>
      <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-site-plugin</artifactId>
      <inherited>false</inherited>
      <executions>
        <execution>
          <id>attach-descriptor</id>
          <goals>
            <goal>attach-descriptor</goal>
          </goals>
        </execution>
      </executions>
    </plugin>
  </plugins>
</build>

Since version 34 repositories section has been moved to the use-apache-snapshots profile
Apache snapshot repository is now optional, and is only added when the profile is activated.

It can be activated by setting the apache.snapshots property (via CLI) or activating the use-apache-snapshots profile directly. Activating from the POM is not possible.

Apache Software Foundation Parent POM

The apache-release Profile

Settings Configuration

Notices

The `apache-release` Profile