You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by vy...@apache.org on 2022/12/21 21:07:59 UTC
[logging-log4j-tools] 01/05: Hardening project infrastructure with more Maven plugins
This is an automated email from the ASF dual-hosted git repository.
vy pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4j-tools.git
commit 6ae16aea4e10b7f484c50952f1cb07c7af16e4de
Author: Volkan Yazıcı <vo...@yazi.ci>
AuthorDate: Mon Dec 19 13:33:13 2022 +0100
Hardening project infrastructure with more Maven plugins
---
.editorconfig | 66 ++++++++++
SECURITY.adoc | 21 ++++
log4j-changelog/pom.xml | 8 ++
.../org/apache/logging/log4j/tools/XmlReader.java | 8 +-
.../org/apache/logging/log4j/tools/XmlWriter.java | 8 +-
.../log4j/tools/changelog/ChangelogEntry.java | 1 +
.../log4j/tools/changelog/ChangelogRelease.java | 1 +
.../tools/changelog/exporter/AsciiDocExporter.java | 20 ++--
.../tools/changelog/importer/MavenChanges.java | 1 +
.../changelog/importer/MavenChangesImporter.java | 8 +-
.../changelog/releaser/ChangelogReleaser.java | 13 +-
pom.xml | 133 ++++++++++++++++++++-
12 files changed, 267 insertions(+), 21 deletions(-)
diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..4274445
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,66 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Configuration here must match the one for Spotless in `pom.xml`!
+
+root = true
+
+[*]
+indent_size = 4
+ij_continuation_indent_size = 8
+indent_style = space
+trim_trailing_whitespace = true
+
+# `ij_any_use_relative_indents = true` is deliberately left out since it messes up the indentation in ternary operator usages
+
+# Split some things over multiple lines to keep lines short
+ij_any_call_parameters_wrap = on_every_item
+ij_any_method_parameters_wrap = on_every_item
+ij_any_method_call_chain_wrap = on_every_item
+
+# Don't align with the first line to avoid single-line changes having an impact in the rest of the code
+ij_any_align_multiline_parameters_in_calls = false
+ij_any_align_multiline_parameters = false
+ij_any_align_multiline_chained_methods = false
+
+# Only use `import *` when importing 5 or more
+ij_java_names_count_to_use_import_on_demand = 5
+ij_java_class_count_to_use_import_on_demand = 5
+
+# Order imports
+# `*` denotes any packages except explicitly specified ones
+# `|` denotes a blank line
+# `$` denotes the prefix for static packages
+# `**` means including subpackages
+ij_java_imports_layout = java.**, |, javax.**, |, org.apache.logging.**, |, *, |, $java.**, |, $javax.**, |, $org.apache.logging.**, |, $*
+
+# Force curly braces
+ij_any_for_brace_force = always
+ij_any_if_brace_force = always
+ij_any_do_while_brace_force = always
+ij_any_while_brace_force = always
+
+# Don't align parameters and exceptions in javadoc based on the longest names to avoid single-line changes having an impact in the rest of the code
+ij_java_doc_align_param_comments = false
+ij_java_doc_align_exception_comments = false
+
+[*.{xml,properties,yml,yaml,json}]
+indent_size = 2
+
+[*.{md,adoc}]
+indent_size = 2
+ij_any_wrap_long_lines = false
+# The `no` value doesn't work in IntelliJ IDEA so a big number does the trick as well in most cases:
+max_line_length = 9999
diff --git a/SECURITY.adoc b/SECURITY.adoc
new file mode 100644
index 0000000..cbbb429
--- /dev/null
+++ b/SECURITY.adoc
@@ -0,0 +1,21 @@
+////
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements. See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License. You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+////
+
+= Security Policy
+
+If you have encountered an unlisted security vulnerability or other unexpected behaviour that has security impact, please report them privately to mailto:security@logging.apache.org[the Log4j security mailing list].
+See https://logging.apache.org/log4j/2.x/security.html[the Log4j Security page] for further details.
diff --git a/log4j-changelog/pom.xml b/log4j-changelog/pom.xml
index 6b01ea7..a826146 100644
--- a/log4j-changelog/pom.xml
+++ b/log4j-changelog/pom.xml
@@ -29,4 +29,12 @@
<artifactId>log4j-changelog</artifactId>
+ <dependencies>
+ <dependency>
+ <groupId>com.github.spotbugs</groupId>
+ <artifactId>spotbugs-annotations</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ </dependencies>
+
</project>
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlReader.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlReader.java
index f2d8465..6e203a2 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlReader.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlReader.java
@@ -23,8 +23,13 @@ import java.util.List;
import java.util.stream.Collectors;
import java.util.stream.IntStream;
import java.util.stream.Stream;
-import javax.xml.parsers.*;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
@@ -55,6 +60,7 @@ public final class XmlReader {
}
}
+ @SuppressFBWarnings("XXE_SAXPARSER")
private static Document readXml(final InputStream inputStream) throws Exception {
final SAXParserFactory parserFactory = SAXParserFactory.newInstance();
final SAXParser parser = parserFactory.newSAXParser();
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlWriter.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlWriter.java
index 1665ac3..78a0f59 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlWriter.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/XmlWriter.java
@@ -23,6 +23,7 @@ import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardOpenOption;
import java.util.function.Consumer;
+
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.transform.OutputKeys;
@@ -31,6 +32,7 @@ import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import org.w3c.dom.Comment;
import org.w3c.dom.Document;
@@ -44,7 +46,10 @@ public final class XmlWriter {
try {
final String xml = toString(documentConsumer);
final byte[] xmlBytes = xml.getBytes(ENCODING);
- Files.createDirectories(filepath.getParent());
+ Path filepathParent = filepath.getParent();
+ if (filepathParent != null) {
+ Files.createDirectories(filepathParent);
+ }
Files.write(filepath, xmlBytes, StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING);
} catch (final Exception error) {
final String message = String.format("failed writing XML to file `%s`", filepath);
@@ -91,6 +96,7 @@ public final class XmlWriter {
}
}
+ @SuppressFBWarnings({"XXE_DTD_TRANSFORM_FACTORY", "XXE_XSLT_TRANSFORM_FACTORY"})
private static String serializeXmlDocument(final Document document) throws Exception {
final Transformer transformer = TransformerFactory.newInstance().newTransformer();
final StreamResult result = new StreamResult(new StringWriter());
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogEntry.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogEntry.java
index cf46cdd..fb5b130 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogEntry.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogEntry.java
@@ -23,6 +23,7 @@ import java.util.stream.Collectors;
import org.apache.logging.log4j.tools.XmlReader;
import org.apache.logging.log4j.tools.XmlWriter;
+
import org.w3c.dom.Element;
import static org.apache.logging.log4j.tools.StringUtils.trimNullable;
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogRelease.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogRelease.java
index beb5508..cb74175 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogRelease.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/ChangelogRelease.java
@@ -20,6 +20,7 @@ import java.nio.file.Path;
import org.apache.logging.log4j.tools.XmlReader;
import org.apache.logging.log4j.tools.XmlWriter;
+
import org.w3c.dom.Element;
import static org.apache.logging.log4j.tools.StringUtils.trimNullable;
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/exporter/AsciiDocExporter.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/exporter/AsciiDocExporter.java
index d236e3d..23220dd 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/exporter/AsciiDocExporter.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/exporter/AsciiDocExporter.java
@@ -16,12 +16,6 @@
*/
package org.apache.logging.log4j.tools.changelog.exporter;
-import org.apache.logging.log4j.tools.AsciiDocUtils;
-import org.apache.logging.log4j.tools.FileUtils;
-import org.apache.logging.log4j.tools.changelog.ChangelogEntry;
-import org.apache.logging.log4j.tools.changelog.ChangelogFiles;
-import org.apache.logging.log4j.tools.changelog.ChangelogRelease;
-
import java.io.IOException;
import java.io.UncheckedIOException;
import java.nio.charset.StandardCharsets;
@@ -34,6 +28,14 @@ import java.util.Locale;
import java.util.Map;
import java.util.stream.Collectors;
+import org.apache.logging.log4j.tools.AsciiDocUtils;
+import org.apache.logging.log4j.tools.FileUtils;
+import org.apache.logging.log4j.tools.changelog.ChangelogEntry;
+import org.apache.logging.log4j.tools.changelog.ChangelogFiles;
+import org.apache.logging.log4j.tools.changelog.ChangelogRelease;
+
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
+
public final class AsciiDocExporter {
private static final String AUTO_GENERATION_WARNING_ASCIIDOC = "////\n" +
@@ -181,7 +183,10 @@ public final class AsciiDocExporter {
throws IOException {
final String asciiDocFilename = changelogReleaseAsciiDocFilename(release);
final Path asciiDocFile = outputDirectory.resolve(asciiDocFilename);
- Files.createDirectories(asciiDocFile.getParent());
+ Path asciiDocFileParent = asciiDocFile.getParent();
+ if (asciiDocFileParent != null) {
+ Files.createDirectories(asciiDocFileParent);
+ }
final String asciiDoc = exportReleaseToAsciiDoc(release, introAsciiDoc, entries);
final byte[] asciiDocBytes = asciiDoc.getBytes(StandardCharsets.UTF_8);
Files.write(asciiDocFile, asciiDocBytes, StandardOpenOption.CREATE, StandardOpenOption.TRUNCATE_EXISTING);
@@ -365,6 +370,7 @@ public final class AsciiDocExporter {
}
}
+ @SuppressFBWarnings("VA_FORMAT_STRING_USES_NEWLINE")
private static String exportReleaseIndexToAsciiDoc(final List<ChangelogRelease> changelogReleases) {
final StringBuilder stringBuilder = new StringBuilder();
stringBuilder
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChanges.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChanges.java
index 84b9814..1c76510 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChanges.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChanges.java
@@ -22,6 +22,7 @@ import java.util.List;
import java.util.Locale;
import org.apache.logging.log4j.tools.XmlReader;
+
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChangesImporter.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChangesImporter.java
index 2494380..f376f08 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChangesImporter.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/importer/MavenChangesImporter.java
@@ -16,14 +16,14 @@
*/
package org.apache.logging.log4j.tools.changelog.importer;
-import org.apache.logging.log4j.tools.changelog.ChangelogEntry;
-import org.apache.logging.log4j.tools.changelog.ChangelogFiles;
-import org.apache.logging.log4j.tools.changelog.ChangelogRelease;
-
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.List;
+import org.apache.logging.log4j.tools.changelog.ChangelogEntry;
+import org.apache.logging.log4j.tools.changelog.ChangelogFiles;
+import org.apache.logging.log4j.tools.changelog.ChangelogRelease;
+
import static org.apache.logging.log4j.tools.StringUtils.isBlank;
public final class MavenChangesImporter {
diff --git a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/releaser/ChangelogReleaser.java b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/releaser/ChangelogReleaser.java
index f282706..72b0e7b 100644
--- a/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/releaser/ChangelogReleaser.java
+++ b/log4j-changelog/src/main/java/org/apache/logging/log4j/tools/changelog/releaser/ChangelogReleaser.java
@@ -16,12 +16,6 @@
*/
package org.apache.logging.log4j.tools.changelog.releaser;
-import org.apache.logging.log4j.tools.AsciiDocUtils;
-import org.apache.logging.log4j.tools.FileUtils;
-import org.apache.logging.log4j.tools.VersionUtils;
-import org.apache.logging.log4j.tools.changelog.ChangelogFiles;
-import org.apache.logging.log4j.tools.changelog.ChangelogRelease;
-
import java.io.IOException;
import java.io.UncheckedIOException;
import java.nio.charset.StandardCharsets;
@@ -29,7 +23,14 @@ import java.nio.file.Files;
import java.nio.file.Path;
import java.time.LocalDate;
+import org.apache.logging.log4j.tools.AsciiDocUtils;
+import org.apache.logging.log4j.tools.FileUtils;
+import org.apache.logging.log4j.tools.VersionUtils;
+import org.apache.logging.log4j.tools.changelog.ChangelogFiles;
+import org.apache.logging.log4j.tools.changelog.ChangelogRelease;
+
import static java.time.format.DateTimeFormatter.ISO_DATE;
+
import static org.apache.logging.log4j.tools.changelog.ChangelogFiles.releaseDirectory;
public final class ChangelogReleaser {
diff --git a/pom.xml b/pom.xml
index d4b15d8..0b18eff 100644
--- a/pom.xml
+++ b/pom.xml
@@ -65,13 +65,48 @@
<!-- `project.build.outputTimestamp` is required for reproducible builds: https://maven.apache.org/guides/mini/guide-reproducible-builds.html -->
<project.build.outputTimestamp>0</project.build.outputTimestamp>
+ <!-- dependency versions -->
+ <spotbugs.version>4.7.3</spotbugs.version>
+
<!-- plugin versions -->
<error-prone.version>2.16</error-prone.version>
+ <findsecbugs-plugin.version>1.12.0</findsecbugs-plugin.version>
<flatten-maven-plugin.version>1.3.0</flatten-maven-plugin.version>
+ <spotbugs-maven-plugin.version>${spotbugs.version}.0</spotbugs-maven-plugin.version>
+ <spotless-maven-plugin.version>2.28.0</spotless-maven-plugin.version>
</properties>
+ <dependencyManagement>
+ <dependencies>
+ <dependency>
+ <groupId>com.github.spotbugs</groupId>
+ <artifactId>spotbugs-annotations</artifactId>
+ <version>${spotbugs.version}</version>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
+
<build>
+
+ <pluginManagement>
+ <plugins>
+
+ <plugin>
+ <groupId>com.github.spotbugs</groupId>
+ <artifactId>spotbugs-maven-plugin</artifactId>
+ <version>${spotbugs-maven-plugin.version}</version>
+ </plugin>
+
+ <plugin>
+ <groupId>com.diffplug.spotless</groupId>
+ <artifactId>spotless-maven-plugin</artifactId>
+ <version>${spotless-maven-plugin.version}</version>
+ </plugin>
+
+ </plugins>
+ </pluginManagement>
+
<plugins>
<plugin>
@@ -124,7 +159,101 @@
</executions>
</plugin>
- </plugins>
- </build>
+ <!-- Apache RAT (Release Audit Tool) check to verify licenses.
+ `apache-rat-plugin`: https://creadur.apache.org/rat/apache-rat-plugin/
+ Release Audit Tool: https://creadur.apache.org/rat/index.html -->
+ <plugin>
+ <groupId>org.apache.rat</groupId>
+ <artifactId>apache-rat-plugin</artifactId>
+ <configuration>
+ <consoleOutput>true</consoleOutput>
+ <excludes>
+ <exclude>**/target/**/*</exclude>
+ <exclude>.java-version</exclude>
+ <exclude>.mvn/jvm.config</exclude>
+ <!-- IntelliJ IDEA files: -->
+ <exclude>.idea/**/*</exclude>
+ <exclude>**/*.iml</exclude>
+ </excludes>
+ </configuration>
+ <executions>
+ <execution>
+ <phase>verify</phase>
+ <goals>
+ <goal>check</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
+
+ <!-- Ensure that version for each dependency resolved during a build, is equal to or higher than all transitive dependency declarations.
+ A failure here requires adding the dependency to the dependency management. -->
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-enforcer-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>enforce-upper-bound-deps</id>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <configuration>
+ <rules>
+ <requireUpperBoundDeps/>
+ </rules>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+
+ <!-- Configuration here must match the one in `.editorconfig`! -->
+ <plugin>
+ <groupId>com.diffplug.spotless</groupId>
+ <artifactId>spotless-maven-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>default-spotless</id>
+ <phase>verify</phase>
+ <goals>
+ <goal>check</goal>
+ </goals>
+ </execution>
+ </executions>
+ <configuration>
+ <ratchetFrom>HEAD~31</ratchetFrom>
+ <java>
+ <importOrder>
+ <order>java,javax,org.apache.logging,,\#java,\#javax,\#org.apache.logging,\#</order>
+ </importOrder>
+ </java>
+ </configuration>
+ </plugin>
+
+ <plugin>
+ <groupId>com.github.spotbugs</groupId>
+ <artifactId>spotbugs-maven-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>default-spotbugs</id>
+ <phase>verify</phase>
+ <goals>
+ <goal>check</goal>
+ </goals>
+ </execution>
+ </executions>
+ <configuration>
+ <plugins>
+ <plugin>
+ <groupId>com.h3xstream.findsecbugs</groupId>
+ <artifactId>findsecbugs-plugin</artifactId>
+ <version>${findsecbugs-plugin.version}</version>
+ </plugin>
+ </plugins>
+ </configuration>
+ </plugin>
+
+</plugins>
+
+</build>
</project>