DOCSEARCHbyAlgolia
Submit Docs

Apache Maven

repository·master·Indexed 26 days ago

https://github.com/apache/maven

A software project management and comprehension tool that uses a Project Object Model (POM) to manage project builds, reporting, and documentation. This documentation covers bootstrapping Maven from source, configuring JVM options via .mvn/jvm.config, environment variable settings (such as JAVA_HOME and MAVEN_OPTS), and running core integration tests using Docker, Vagrant, or custom builds.

Tokens
21.4K
Snippets
17
Records
161
Agent score
82%

What's inside Apache Maven

  1. Understand the Apache Maven security model

    master

    Apache Maven is a build-automation and dependency-management tool for JVM projects. Its security model is fundamentally a supply-chain and arbitrary-code-execution model.

    Key Security Principles:

    • No Sandboxing: By design, Maven does not sandbox the code it builds or the plugins it runs. Plugins and extensions are executed as arbitrary code in the build JVM.
    • Trust Assumption: The Maven security model assumes you trust the pom.xml, the code, the dependencies, and the repositories configured in your build.
    • Operator Responsibility: If you need to build untrusted code, you must provide your own isolation (e.g., containers, VMs) outside of Maven.

  2. Understand the Apache Maven XML Implementation module

    master

    The apache/maven/impl/maven-xml module provides the implementation for handling XML snippets within the Maven object model. It serves two primary purposes:

    1. XML Node Implementation: It implements the org.apache.maven.api.xml.XmlNode interface, which is used to convey XML snippets throughout the Maven object model.
    2. API Interoperability: It includes a modified org.codehaus.plexus.util.xml package. This package wraps immutable objects from org.apache.maven.api.xml.XmlNode to ensure compatibility and interoperability between Maven API v3.x and v4.x.

  3. Access Apache Maven documentation and resources

    master

  5. Run Maven Core Integration Tests against a custom build

    master

    To run integration tests against a custom build of Maven, use the mvn clean install command with the -Prun-its profile. You must specify a local repository path using -Dmaven.repo.local and the path to your Maven distribution using -DmavenDistro.

    mvn clean install -Prun-its -Dmaven.repo.local=`pwd`/repo -DmavenDistro=/path/to/apache-maven-dist.zip

  7. Run Maven Core Integration Tests using the provided script

    master
    Alternatively, you can run the integration tests using the run-its.sh script. First, build Maven core using the -PversionlessMavenDist profile, then execute the script.

  8. Secure remote repository connections

    master
    Maven blocks plaintext http:// external repositories by default via the external:http:* mirror mechanism in the shipped conf/settings.xml. This mitigates Man-in-the-Middle (MITM) attacks. Ensure your repositories use HTTPS to maintain transport security.

  9. Add custom JLine native builds for unsupported platforms

    master

    If your platform is not natively supported by the JLine libraries included in this directory, you can add your own build.

    To implement this, follow these steps:

    1. Compile for your platform: Refer to the JLine native compilation guide at https://github.com/jline/jline3/tree/master/native.
    2. Follow naming conventions: Ensure your libraries adhere to JLine's directory and filename conventions as defined in https://github.com/jline/jline3/blob/master/native/src/main/java/org/jline/nativ/OSInfo.java.

  11. Run Maven Core Integration Tests behind a proxy

    master

    If you are running integration tests behind a proxy, include the proxy configuration properties in your Maven command: -Dproxy.active=true, -Dproxy.type, -Dproxy.host, -Dproxy.port, -Dproxy.user, and -Dproxy.pass.

    mvn clean install -Prun-its -Dmaven.repo.local=`pwd`/repo -DmavenDistro=/path/to/apache-maven-dist.zip -Dproxy.active=true -Dproxy.type=http -Dproxy.host=... -Dproxy.port=... -Dproxy.user=... -Dproxy.pass=...