Description

<dependency>
    <groupId>org.owasp</groupId>
    <artifactId>oag</artifactId>
    <version>0.7.1</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <!-- updating the version needs also updating spring-cloud.version see below. -->
        <version>3.4.1</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <groupId>org.owasp</groupId>
    <artifactId>oag</artifactId>
    <version>0.7.1</version>

    <name>OWASP Application Gateway</name>
    <description>An elephant strong web application gateway that handles oauth2 authentication and session management.
    </description>
    <packaging>jar</packaging>

    <licenses>
        <license>

            <name>The Apache License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
        </license>
    </licenses>

    <organization>
        <name>OWASP</name>
        <url>http://www.owasp.org</url>
    </organization>

    <developers>
        <developer>
            <id>gianlucafrei</id>
            <name>Gian-Luca Frei</name>
            <email>gian-luca.frei@owasp.org</email>
        </developer>
        <developer>
            <id>Padi-owasp</id>
            <name>Patrick Steger</name>
            <email>padi.steger@owasp.org</email>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:git://github.com/gianlucafrei/Application-Gateway.git</connection>
        <developerConnection>scm:git:ssh://github.com/gianlucafrei/Application-Gateway.git</developerConnection>
        <url>https://github.com/gianlucafrei/Application-Gateway</url>
    </scm>

    <properties>
        <java.version>17</java.version>
        <!-- updating this version needs also updating the parent, see https://spring.io/projects/spring-cloud -->
        <spring-cloud.version>2024.0.0</spring-cloud.version>
    </properties>

    <dependencies>
        <!-- START SECURITY FIXES SECTION (updates/explicit packages for vulnerability patching only) -->
        <!-- temporary add here library updates to override versions introduced as sub-dependencies by boms -->

        <!-- remove when updating cloud-starter-gateway or spring-cloud-version -->
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-common</artifactId>
            <version>4.1.119.Final</version>
        </dependency>
        <dependency>
            <groupId>io.netty</groupId>
            <artifactId>netty-handler</artifactId>
            <version>4.1.119.Final</version>
        </dependency>
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <version>1.5.17</version>
        </dependency>
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-core</artifactId>
            <version>1.5.17</version>
        </dependency>
        <dependency>
            <groupId>net.minidev</groupId>
            <artifactId>json-smart</artifactId>
            <version>2.5.2</version>
        </dependency>
        <!-- wiremock dependency -->
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>2.18.0</version>
        </dependency>

        <!-- END SECURITY FIXES SECTION -->

        <!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>33.4.0-jre</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
        <dependency>
            <groupId>org.yaml</groupId>
            <artifactId>snakeyaml</artifactId>
            <version>2.3</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/com.nimbusds/oauth2-oidc-sdk -->
        <dependency>
            <groupId>com.nimbusds</groupId>
            <artifactId>oauth2-oidc-sdk</artifactId>
            <version>11.23.1</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/com.nimbusds/nimbus-jose-jwt -->
        <dependency>
            <groupId>com.nimbusds</groupId>
            <artifactId>nimbus-jose-jwt</artifactId>
            <version>9.48</version>
        </dependency>

        <dependency>
            <groupId>io.github.artsok</groupId>
            <artifactId>rerunner-jupiter</artifactId>
            <version>2.1.6</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.mapdb/mapdb -->
        <dependency>
            <groupId>org.mapdb</groupId>
            <artifactId>mapdb</artifactId>
            <version>3.1.0</version>
        </dependency>

        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.17.0</version>
        </dependency>

        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
            <version>1.17.1</version>
        </dependency>

        <dependency>
            <groupId>org.antlr</groupId>
            <artifactId>ST4</artifactId>
            <version>4.3.4</version>
            <scope>compile</scope>
        </dependency>

        <!-- Manual Versioned  Test Dependencies -->
        <!-- https://mvnrepository.com/artifact/com.github.ben-manes.caffeine/caffeine -->
        <dependency>
            <groupId>com.github.ben-manes.caffeine</groupId>
            <artifactId>caffeine</artifactId>
            <version>3.1.8</version>
        </dependency>

        <!-- https://mvnrepository.com/artifact/org.wiremock/wiremock -->
        <dependency>
            <groupId>org.wiremock</groupId>
            <artifactId>wiremock</artifactId>
            <version>3.10.0</version>
            <type>pom</type>
            <scope>test</scope>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-contract-wiremock -->
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-contract-wiremock</artifactId>
            <version>4.2.0 </version>
            <scope>test</scope>
        </dependency>

        <!-- End manual dependency Versions-->
        <dependency>
            <groupId>com.fasterxml.jackson.dataformat</groupId>
            <artifactId>jackson-dataformat-yaml</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-gateway</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-loadbalancer</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-api</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-engine</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <extensions>
            <extension>
                <groupId>kr.motd.maven</groupId>
                <artifactId>os-maven-plugin</artifactId>
                <version>1.7.1</version>
            </extension>
        </extensions>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>repackage</id>
                        <goals>
                            <goal>repackage</goal>
                        </goals>
                        <configuration>
                            <classifier>exec</classifier>
                            <finalName>oag</finalName>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.3.1</version>
                <configuration>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>3.3.1</version>
                <executions>
                    <execution>
                        <id>attach-sources</id>
                        <goals>
                            <goal>jar-no-fork</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>3.11.2</version>
                <executions>
                    <execution>
                        <id>attach-javadocs</id>
                        <goals>
                            <goal>jar</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <additionalOptions>-Xdoclint:none</additionalOptions>
                    <additionalJOption>-Xdoclint:none</additionalJOption>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.sonatype.plugins</groupId>
                <artifactId>nexus-staging-maven-plugin</artifactId>
                <version>1.7.0</version>
                <extensions>true</extensions>
                <configuration>
                    <serverId>ossrh</serverId>
                    <nexusUrl>https://oss.sonatype.org/</nexusUrl>
                    <autoReleaseAfterClose>false</autoReleaseAfterClose>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-deploy-plugin</artifactId>
                <configuration>
                    <skip>true</skip>
                </configuration>
            </plugin>
            <!-- To generate a self-signed certificate. -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <version>3.5.0</version>
                <executions>
                    <execution>
                        <phase>generate-resources</phase>
                        <goals>
                            <goal>exec</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <executable>keytool</executable>
                    <workingDirectory>.</workingDirectory>
                    <arguments>
                        <argument>-genkeypair</argument>
                        <argument>-alias</argument>
                        <argument>tls</argument>
                        <argument>-keyalg</argument>
                        <argument>RSA</argument>
                        <argument>-keystore</argument>
                        <argument>keystore.pkcs12</argument>
                        <argument>-storetype</argument>
                        <argument>PKCS12</argument>
                        <argument>-keysize</argument>
                        <argument>2048</argument>
                        <argument>-keypass</argument>
                        <argument>password</argument>
                        <argument>-storepass</argument>
                        <argument>password</argument>
                        <argument>-validity</argument>
                        <argument>720</argument>
                        <argument>-dname</argument>
                        <argument>cn=demo, ou=oag, o=owasp, c=com</argument>
                    </arguments>
                </configuration>
            </plugin>
            <!-- To remove the generated self-signed certificate. -->
            <plugin>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.4.0</version>
                <configuration>
                    <filesets>
                        <fileset>
                            <directory>.</directory>
                            <includes>
                                <include>keystore.pkcs12</include>
                            </includes>
                            <followSymlinks>false</followSymlinks>
                        </fileset>
                    </filesets>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <repositories>
        <repository>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
            <id>central</id>
            <name>Maven Central</name>
            <url>https://repo1.maven.org/maven2</url>
        </repository>
        <repository>
            <id>spring-milestones</id>
            <name>Spring Milestones</name>
            <url>https://repo.spring.io/milestone</url>
        </repository>
    </repositories>

    <profiles>
        <profile>
            <id>gpg-sign</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.2.7</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                                <configuration>
                                    <!-- Prevent gpg from using pinentry programs. Fixes: gpg: signing 
                                        failed: Inappropriate ioctl for device -->
                                    <gpgArguments>
                                        <arg>--pinentry-mode</arg>
                                        <arg>loopback</arg>
                                    </gpgArguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
    </distributionManagement>



    <!--
        Update version:
        > mvn versions:set -DnewVersion=0.0.1-SNAPSHOT -DgenerateBackupPoms=false

        Build OAG executable and library:
        > mvn -B clean package

        Output: - oag-exec.jar (Executable JAR)
                - oag-<VERSION>.jar (Extension library)

        ===================
        Build OAG library and deploy to maven central:
        > mvn -B deploy -Pgpg-sign -DskipTests -DrepositoryID=ossrh
        
        Properties gpg.passphrase and gpg.keyname must be set (command line or settings.xml)
        -->
</project>