You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iotdb.apache.org by qi...@apache.org on 2019/11/30 05:52:03 UTC
[incubator-iotdb] branch revert-590-move_oss_to_profile created
(now 1012a88)
This is an automated email from the ASF dual-hosted git repository.
qiaojialin pushed a change to branch revert-590-move_oss_to_profile
in repository https://gitbox.apache.org/repos/asf/incubator-iotdb.git.
at 1012a88 Revert "Move the vulnera-checks section into the apache-release profile (#590)"
This branch includes the following new commits:
new 1012a88 Revert "Move the vulnera-checks section into the apache-release profile (#590)"
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[incubator-iotdb] 01/01: Revert "Move the vulnera-checks section
into the apache-release profile (#590)"
Posted by qi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
qiaojialin pushed a commit to branch revert-590-move_oss_to_profile
in repository https://gitbox.apache.org/repos/asf/incubator-iotdb.git
commit 1012a88b6b613ab007a66c3d0bcc5466569824bb
Author: Jialin Qiao <qj...@mails.tsinghua.edu.cn>
AuthorDate: Sat Nov 30 13:51:56 2019 +0800
Revert "Move the vulnera-checks section into the apache-release profile (#590)"
This reverts commit 6bae410529b984d76331a21d4d4cf540e078dbad.
---
pom.xml | 160 ++++++++++++++++++++++++++++++++--------------------------------
1 file changed, 80 insertions(+), 80 deletions(-)
diff --git a/pom.xml b/pom.xml
index b8771b9..a29906d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -518,6 +518,86 @@
</pluginManagement>
<plugins>
<!--
+ Strange things usually happen if you run with a too low Java version.
+ This plugin not only checks the minimum java version of 1.8, but also
+ checks all dependencies (and transitive dependencies) for reported CVEs.
+ -->
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-enforcer-plugin</artifactId>
+ <version>3.0.0-M2</version>
+ <!--$NO-MVN-MAN-VER$-->
+ <executions>
+ <!-- Ensure we're not mixing dependency versions -->
+ <execution>
+ <id>enforce-version-convergence</id>
+ <configuration>
+ <rules>
+ <dependencyConvergence/>
+ </rules>
+ </configuration>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ </execution>
+ <!--
+ Fails the build if classes are included from multiple
+ artifacts and these are not identical.
+ -->
+ <!--execution>
+ <id>enforce-ban-duplicate-classes</id>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <configuration>
+ <rules>
+ <banDuplicateClasses>
+ <scopes>
+ <scope>compile</scope>
+ <scope>provided</scope>
+ </scopes>
+ <findAllDuplicates>true</findAllDuplicates>
+ <ignoreWhenIdentical>true</ignoreWhenIdentical>
+ </banDuplicateClasses>
+ </rules>
+ <fail>true</fail>
+ </configuration>
+ </execution-->
+ <!-- Make sure no dependencies are used for which known vulnerabilities exist. -->
+ <execution>
+ <id>vulnerability-checks</id>
+ <phase>validate</phase>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <configuration>
+ <!-- Just generate warnings for now -->
+ <fail>false</fail>
+ <rules>
+ <requireJavaVersion>
+ <version>1.8.0</version>
+ </requireJavaVersion>
+ <!-- Disabled for now as it breaks the ability to build single modules -->
+ <!--reactorModuleConvergence/-->
+ <banVulnerable implementation="org.sonatype.ossindex.maven.enforcer.BanVulnerableDependencies"/>
+ </rules>
+ </configuration>
+ </execution>
+ </executions>
+ <dependencies>
+ <dependency>
+ <groupId>org.sonatype.ossindex.maven</groupId>
+ <artifactId>ossindex-maven-enforcer-rules</artifactId>
+ <version>1.0.0</version>
+ </dependency>
+ <dependency>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>extra-enforcer-rules</artifactId>
+ <version>1.2</version>
+ </dependency>
+ </dependencies>
+ </plugin>
+ <!--
Even if Maven transitively pulls in dependencies, relying on these can
quite often cause hard to find problems. So it's a good practice to make
sure everything directly required is also directly added as a dependency.
@@ -955,86 +1035,6 @@
</execution>
</executions>
</plugin>
- <!--
- Strange things usually happen if you run with a too low Java version.
- This plugin not only checks the minimum java version of 1.8, but also
- checks all dependencies (and transitive dependencies) for reported CVEs.
- -->
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-enforcer-plugin</artifactId>
- <version>3.0.0-M2</version>
- <!--$NO-MVN-MAN-VER$-->
- <executions>
- <!-- Ensure we're not mixing dependency versions -->
- <execution>
- <id>enforce-version-convergence</id>
- <configuration>
- <rules>
- <dependencyConvergence/>
- </rules>
- </configuration>
- <goals>
- <goal>enforce</goal>
- </goals>
- </execution>
- <!--
- Fails the build if classes are included from multiple
- artifacts and these are not identical.
- -->
- <!--execution>
- <id>enforce-ban-duplicate-classes</id>
- <goals>
- <goal>enforce</goal>
- </goals>
- <configuration>
- <rules>
- <banDuplicateClasses>
- <scopes>
- <scope>compile</scope>
- <scope>provided</scope>
- </scopes>
- <findAllDuplicates>true</findAllDuplicates>
- <ignoreWhenIdentical>true</ignoreWhenIdentical>
- </banDuplicateClasses>
- </rules>
- <fail>true</fail>
- </configuration>
- </execution-->
- <!-- Make sure no dependencies are used for which known vulnerabilities exist. -->
- <execution>
- <id>vulnerability-checks</id>
- <phase>validate</phase>
- <goals>
- <goal>enforce</goal>
- </goals>
- <configuration>
- <!-- Just generate warnings for now -->
- <fail>false</fail>
- <rules>
- <requireJavaVersion>
- <version>1.8.0</version>
- </requireJavaVersion>
- <!-- Disabled for now as it breaks the ability to build single modules -->
- <!--reactorModuleConvergence/-->
- <banVulnerable implementation="org.sonatype.ossindex.maven.enforcer.BanVulnerableDependencies"/>
- </rules>
- </configuration>
- </execution>
- </executions>
- <dependencies>
- <dependency>
- <groupId>org.sonatype.ossindex.maven</groupId>
- <artifactId>ossindex-maven-enforcer-rules</artifactId>
- <version>1.0.0</version>
- </dependency>
- <dependency>
- <groupId>org.codehaus.mojo</groupId>
- <artifactId>extra-enforcer-rules</artifactId>
- <version>1.2</version>
- </dependency>
- </dependencies>
- </plugin>
</plugins>
</build>
</profile>