Skip to content

Commit 165f02e

Browse files
hj690hj690
authored
build(deps): pin native-maven-plugin and override download-maven-plugin plexus dependency for Airlock (#14754)
## Summary This PR resolves the two remaining plugin dependency issues reported by the `java-missing-airlock-deps` audit (b/568717591): 1. **Pin `org.graalvm.buildtools:native-maven-plugin` to `${native-maven-plugin.version}` (`0.10.6`)**: - `java-shared-config/native-image-shared-config/pom.xml` previously declared `<version>${native-maven-plugin.version}</version>` only inside `<profile><id>native</id>`. - Three modules (`google-auth-library-java/credentials`, `google-auth-library-java/appengine`, and `java-spanner/google-cloud-spanner`) configure `native-maven-plugin` in top-level `<build><plugins>` without `<version>`. When `-Pnative` is inactive, Maven resolves the latest version from `maven-metadata.xml` (`1.1.16`), which is still in Airlock's 14-day soak window. - Add `native-maven-plugin` to `<build><pluginManagement><plugins>` in `native-image-shared-config/pom.xml` and set `<version>${native-maven-plugin.version}</version>` in those three modules (matching `grpc-gcp-java/pom.xml`). 2. **Override `org.codehaus.plexus:plexus-container-default` to `1.0-alpha-9-stable-1` in `download-maven-plugin:1.6.8`**: - `com.googlecode.maven-download-plugin:download-maven-plugin:1.6.8` in `java-showcase/gapic-showcase` and `sdk-platform-java/gapic-generator-java` transitively pulls `org.codehaus.plexus:plexus-container-default:1.0-alpha-8`, which Airlock parks in `standard-maven-3p-l1-limited-internal-use` due to missing upstream license metadata. - Add a plugin `<dependency>` override pinning `org.codehaus.plexus:plexus-container-default` to `1.0-alpha-9-stable-1` (with `*:*` exclusions), which is available in `maven-3p-trusted`.
1 parent ecd27c5 commit 165f02e

8 files changed

Lines changed: 60 additions & 0 deletions

File tree

  • google-auth-library-java
  • java-shared-config/native-image-shared-config
  • java-showcase/gapic-showcase
  • java-spanner/google-cloud-spanner
  • sdk-platform-java
    • gapic-generator-java
    • java-showcase-3.21.0/gapic-showcase
    • java-showcase-3.25.8/gapic-showcase

‎google-auth-library-java/appengine/pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
<plugin>
4646
<groupId>org.graalvm.buildtools</groupId>
4747
<artifactId>native-maven-plugin</artifactId>
48+
<version>${native-maven-plugin.version}</version>
4849
<configuration>
4950
<skipNativeTests>true</skipNativeTests>
5051
</configuration>

‎google-auth-library-java/credentials/pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
<plugin>
2626
<groupId>org.graalvm.buildtools</groupId>
2727
<artifactId>native-maven-plugin</artifactId>
28+
<version>${native-maven-plugin.version}</version>
2829
<configuration>
2930
<skipNativeTests>true</skipNativeTests>
3031
</configuration>

‎java-shared-config/native-image-shared-config/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,11 @@
101101
<artifactId>maven-deploy-plugin</artifactId>
102102
<version>3.1.4</version>
103103
</plugin>
104+
<plugin>
105+
<groupId>org.graalvm.buildtools</groupId>
106+
<artifactId>native-maven-plugin</artifactId>
107+
<version>${native-maven-plugin.version}</version>
108+
</plugin>
104109
</plugins>
105110
</pluginManagement>
106111
<plugins>

‎java-showcase/gapic-showcase/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,19 @@
5656
<groupId>com.googlecode.maven-download-plugin</groupId>
5757
<artifactId>download-maven-plugin</artifactId>
5858
<version>1.6.8</version>
59+
<dependencies>
60+
<dependency>
61+
<groupId>org.codehaus.plexus</groupId>
62+
<artifactId>plexus-container-default</artifactId>
63+
<version>1.0-alpha-9-stable-1</version>
64+
<exclusions>
65+
<exclusion>
66+
<groupId>*</groupId>
67+
<artifactId>*</artifactId>
68+
</exclusion>
69+
</exclusions>
70+
</dependency>
71+
</dependencies>
5972
<executions>
6073
<execution>
6174
<id>download-compliance-suite</id>

‎java-spanner/google-cloud-spanner/pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@
127127
<plugin>
128128
<groupId>org.graalvm.buildtools</groupId>
129129
<artifactId>native-maven-plugin</artifactId>
130+
<version>${native-maven-plugin.version}</version>
130131
<configuration>
131132
<buildArgs combine.children="append">
132133
<buildArg>-Dspanner.testenv.config.class=${spanner.testenv.config.class}</buildArg>

‎sdk-platform-java/gapic-generator-java/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,19 @@
125125
<groupId>com.googlecode.maven-download-plugin</groupId>
126126
<artifactId>download-maven-plugin</artifactId>
127127
<version>1.6.8</version>
128+
<dependencies>
129+
<dependency>
130+
<groupId>org.codehaus.plexus</groupId>
131+
<artifactId>plexus-container-default</artifactId>
132+
<version>1.0-alpha-9-stable-1</version>
133+
<exclusions>
134+
<exclusion>
135+
<groupId>*</groupId>
136+
<artifactId>*</artifactId>
137+
</exclusion>
138+
</exclusions>
139+
</dependency>
140+
</dependencies>
128141
<executions>
129142
<execution>
130143
<id>download-metadata-proto</id>

‎sdk-platform-java/java-showcase-3.21.0/gapic-showcase/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,19 @@
4848
<groupId>com.googlecode.maven-download-plugin</groupId>
4949
<artifactId>download-maven-plugin</artifactId>
5050
<version>1.6.8</version>
51+
<dependencies>
52+
<dependency>
53+
<groupId>org.codehaus.plexus</groupId>
54+
<artifactId>plexus-container-default</artifactId>
55+
<version>1.0-alpha-9-stable-1</version>
56+
<exclusions>
57+
<exclusion>
58+
<groupId>*</groupId>
59+
<artifactId>*</artifactId>
60+
</exclusion>
61+
</exclusions>
62+
</dependency>
63+
</dependencies>
5164
<executions>
5265
<execution>
5366
<id>download-compliance-suite</id>

‎sdk-platform-java/java-showcase-3.25.8/gapic-showcase/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,19 @@
5656
<groupId>com.googlecode.maven-download-plugin</groupId>
5757
<artifactId>download-maven-plugin</artifactId>
5858
<version>1.6.8</version>
59+
<dependencies>
60+
<dependency>
61+
<groupId>org.codehaus.plexus</groupId>
62+
<artifactId>plexus-container-default</artifactId>
63+
<version>1.0-alpha-9-stable-1</version>
64+
<exclusions>
65+
<exclusion>
66+
<groupId>*</groupId>
67+
<artifactId>*</artifactId>
68+
</exclusion>
69+
</exclusions>
70+
</dependency>
71+
</dependencies>
5972
<executions>
6073
<execution>
6174
<id>download-compliance-suite</id>

0 commit comments

Comments
 (0)