Skip to content

Commit

Permalink
fix: Maven plugins and vulnerability fix (#32)
Browse files Browse the repository at this point in the history 
vulnerability fix GHSA-pfh2-hfmq-phg5, Score: 5.3

Included Maven plugins for generating source JARs, Javadoc JARs, and
checksum files across multiple project POMs. Also added a new protobuf
Java dependency and updated project URLs in the main POM. These changes
enhance build reproducibility and artifact verification.
  • Loading branch information
@pflynn-virtru
pflynn-virtru authored Oct 21, 2024
1 parent 38f207d commit fda54ff
Show file tree
Hide file tree
Showing 5 changed files with 260 additions and 1 deletion.
60 changes: 60 additions & 0 deletions nifi-tdf-controller-services-api-nar/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,66 @@
<groupId>org.apache.nifi</groupId>
<artifactId>nifi-nar-maven-plugin</artifactId>
</plugin>
<!-- Plugin to create source JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>3.3.1</version>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to create Javadoc JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.8.0</version>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to generate checksum files -->
<plugin>
<groupId>net.nicoulaj.maven.plugins</groupId>
<artifactId>checksum-maven-plugin</artifactId>
<version>1.11</version>
<executions>
<execution>
<id>create-checksums</id>
<phase>package</phase>
<goals>
<goal>files</goal>
</goals>
<configuration>
<algorithms>
<algorithm>MD5</algorithm>
<algorithm>SHA-1</algorithm>
<algorithm>SHA-256</algorithm>
<algorithm>SHA-512</algorithm>
</algorithms>
<failOnError>true</failOnError>
<fileSets>
<fileSet>
<directory>${project.build.directory}</directory>
<includes>
<include>*.nar</include>
</includes>
</fileSet>
</fileSets>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
64 changes: 64 additions & 0 deletions nifi-tdf-controller-services-api/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,4 +31,68 @@
<version>${nifi.version}</version>
</dependency>
</dependencies>
<build>
<plugins>
<!-- Plugin to create source JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>3.3.1</version>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to create Javadoc JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.8.0</version>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to generate checksum files -->
<plugin>
<groupId>net.nicoulaj.maven.plugins</groupId>
<artifactId>checksum-maven-plugin</artifactId>
<version>1.11</version>
<executions>
<execution>
<id>create-checksums</id>
<phase>package</phase>
<goals>
<goal>files</goal>
</goals>
<configuration>
<algorithms>
<algorithm>MD5</algorithm>
<algorithm>SHA-1</algorithm>
<algorithm>SHA-256</algorithm>
<algorithm>SHA-512</algorithm>
</algorithms>
<failOnError>true</failOnError>
<fileSets>
<fileSet>
<directory>${project.build.directory}</directory>
<includes>
<include>*.jar</include>
</includes>
</fileSet>
</fileSets>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
60 changes: 60 additions & 0 deletions nifi-tdf-nar/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,66 @@
<groupId>org.apache.nifi</groupId>
<artifactId>nifi-nar-maven-plugin</artifactId>
</plugin>
<!-- Plugin to create source JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>3.3.1</version>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to create Javadoc JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.8.0</version>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to generate checksum files -->
<plugin>
<groupId>net.nicoulaj.maven.plugins</groupId>
<artifactId>checksum-maven-plugin</artifactId>
<version>1.11</version>
<executions>
<execution>
<id>create-checksums</id>
<phase>package</phase>
<goals>
<goal>files</goal>
</goals>
<configuration>
<algorithms>
<algorithm>MD5</algorithm>
<algorithm>SHA-1</algorithm>
<algorithm>SHA-256</algorithm>
<algorithm>SHA-512</algorithm>
</algorithms>
<failOnError>true</failOnError>
<fileSets>
<fileSet>
<directory>${project.build.directory}</directory>
<includes>
<include>*.nar</include>
</includes>
</fileSet>
</fileSets>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
Expand Down
64 changes: 64 additions & 0 deletions nifi-tdf-processors/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,4 +97,68 @@
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<!-- Plugin to create source JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-source-plugin</artifactId>
<version>3.3.1</version>
<executions>
<execution>
<id>attach-sources</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to create Javadoc JAR -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.8.0</version>
<executions>
<execution>
<id>attach-javadocs</id>
<goals>
<goal>jar</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Plugin to generate checksum files -->
<plugin>
<groupId>net.nicoulaj.maven.plugins</groupId>
<artifactId>checksum-maven-plugin</artifactId>
<version>1.11</version>
<executions>
<execution>
<id>create-checksums</id>
<phase>package</phase>
<goals>
<goal>files</goal>
</goals>
<configuration>
<algorithms>
<algorithm>MD5</algorithm>
<algorithm>SHA-1</algorithm>
<algorithm>SHA-256</algorithm>
<algorithm>SHA-512</algorithm>
</algorithms>
<failOnError>true</failOnError>
<fileSets>
<fileSet>
<directory>${project.build.directory}</directory>
<includes>
<include>*.jar</include>
</includes>
</fileSet>
</fileSets>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
13 changes: 12 additions & 1 deletion pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,9 @@
<artifactId>nifi-pom</artifactId>
<version>0.6.0-SNAPSHOT</version><!-- {x-version-update:nifi:current} -->
<name>nifi-pom</name>
<packaging>pom</packaging>
<description>NiFi processors for OpenTDF</description>
<url>https://github.com/opentdf/nifi</url>
<packaging>pom</packaging>
<licenses>
<license>
<name>Clear BSD License</name>
Expand Down Expand Up @@ -90,6 +91,16 @@
<version>5.2.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
<version>3.25.5</version>
</dependency>
<dependency>
<groupId>com.jayway.jsonpath</groupId>
<artifactId>json-path</artifactId>
<version>2.9.0</version>
</dependency>
</dependencies>
</dependencyManagement>
<build>
Expand Down

0 comments on commit fda54ff

Please sign in to comment.