[java-parent-project] branch main updated: IDP-1879 Add build notes to all our self-built dependant jars about our build process.

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-parent-project.

View the commit online:
http://git.shibboleth.net/view/?p=java-parent-project.git;a=commit;h=19750211574a10097f5c4900563f0cb5ce8b4b47

The following commit(s) were added to refs/heads/main by this push:
     new 1975021  IDP-1879  Add build notes to all our self-built dependant jars about our build process.
1975021 is described below

commit 19750211574a10097f5c4900563f0cb5ce8b4b47
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sun Nov 7 11:28:33 2021 +0000

    IDP-1879  Add build notes to all our self-built dependant jars about our build process.
    
    https://shibboleth.atlassian.net/browse/IDP-1879
---
 pom.xml | 45 ++++++++++++++++++++++++++++++++-------------
 1 file changed, 32 insertions(+), 13 deletions(-)

diff --git a/pom.xml b/pom.xml
index e240d1c..0343e70 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,6 +18,22 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.release>11</maven.compiler.release>
 
+        <!-- A note about changing dependencies:
+
+         When updating the version of a dependency you *MUST*:
+
+           1) Run a build of the project you are working on with the
+           'central-disabled' profile to ensure that all the artifacts are in
+           the third part repository.
+
+           The jenkins 'nightly' builds run this profile.
+
+           2) Run the (at least) verify phase of the distribution build for
+           the project you are working on to ensure that the artefacts are
+           signed by known keys.
+        -->
+
+
         <ant.version>1.10.10</ant.version>
         <bouncycastle.version>1.68</bouncycastle.version>
         <commons.compress.version>1.20</commons.compress.version>
@@ -205,7 +221,10 @@
         <!-- Test dependencies -->
     </dependencies>
 
-    <!-- Dependencies with fixed versions and excludes that may be used by projects. -->
+    <!-- Dependencies with fixed versions and excludes that may be used by projects.
+
+         See note above about testing changes to dependencies.
+    -->
     <dependencyManagement>
         <dependencies>
             <dependency>
@@ -343,12 +362,12 @@
               <artifactId>jsonapi-converter</artifactId>
               <version>0.10</version>
               <!-- Excluded: https://issues.shibboleth.net/jira/browse/IDP-1798 -->
-	          <exclusions>
-		          <exclusion>
-			         <groupId>com.squareup.retrofit2</groupId>
-			         <artifactId>retrofit</artifactId>
-		          </exclusion>
-	          </exclusions> 
+              <exclusions>
+                  <exclusion>
+                      <groupId>com.squareup.retrofit2</groupId>
+                      <artifactId>retrofit</artifactId>
+                  </exclusion>
+              </exclusions>
             </dependency>
             <dependency>
                 <groupId>${spring.groupId}</groupId>
@@ -494,12 +513,12 @@
                 dependency on jcl-over-slf4j instead, with "runtime" scope,
                 overriding the "provided" below.
             -->
-	        <dependency>
-	            <groupId>${slf4j.groupId}</groupId>
-	            <artifactId>jcl-over-slf4j</artifactId>
-	            <version>${slf4j.version}</version>
-	            <scope>provided</scope>
-	        </dependency>
+                <dependency>
+                    <groupId>${slf4j.groupId}</groupId>
+                    <artifactId>jcl-over-slf4j</artifactId>
+                    <version>${slf4j.version}</version>
+                    <scope>provided</scope>
+                </dependency>
 
             <!-- Other logging bridges that may be required. -->
             <dependency>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.