pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
* OpenFixity is an application for monitoring and reporting on the fixity of files.
* Copyright (C) 2026 Open Preservation Foundation
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*     https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>org.openpreservation.fixity</groupId>
    <artifactId>open-fixity</artifactId>
    <version>0.1.1-ALPHA</version>

    <name>OpenFixity</name>
    <description>An application for monitoring and reporting on the fixity of files.</description>

    <organization>
        <name>Open Preservation Foundation</name>
        <url>https://openpreservation.org/</url>
    </organization>

    <licenses>
        <license>
            <name>The Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <mvn.reportsinfo.version>3.0.0</mvn.reportsinfo.version>
        <dropwizard.version>5.0.1</dropwizard.version>
        <spotbugs.version>4.8.6.6</spotbugs.version>
        <frontend.plugin.version>1.15.1</frontend.plugin.version>
        <!-- Node is downloaded and used only for the build; it is not a runtime dependency. -->
        <frontend.node.version>v22.12.0</frontend.node.version>
        <!-- Set -DskipFrontend=true to build the backend alone, without Node. -->
        <skipFrontend>false</skipFrontend>
        <javafx.version>17.0.10</javafx.version>
        <!-- Default native classifier; the os-activated profiles below override it. JavaFX
             ships per-platform native jars, so the classifier must match the build machine. -->
        <javafx.platform>linux</javafx.platform>
    </properties>
    <dependencies>
        <dependency>
            <groupId>jakarta.persistence</groupId>
            <artifactId>jakarta.persistence-api</artifactId>
            <version>3.2.0</version>
            <scope>compile</scope>
        </dependency>
        <!--
          H2 is loaded reflectively at runtime via the driverClass in the server config,
          so bytecode analysis cannot see it. mvn dependency:analyze reports it as an
          unused declared dependency. It is not. Removing it compiles fine and then fails
          at startup.
        -->
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <version>2.4.240</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.quartz-scheduler</groupId>
            <artifactId>quartz</artifactId>
            <version>2.5.2</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.21.0</version>
        </dependency>
        <dependency>
            <groupId>io.dropwizard</groupId>
            <artifactId>dropwizard-core</artifactId>
            <version>${dropwizard.version}</version>
        </dependency>
        <dependency>
            <groupId>io.dropwizard</groupId>
            <artifactId>dropwizard-hibernate</artifactId>
            <version>${dropwizard.version}</version>
        </dependency>
        <dependency>
            <groupId>io.dropwizard</groupId>
            <artifactId>dropwizard-views</artifactId>
            <version>${dropwizard.version}</version>
        </dependency>
        <dependency>
            <groupId>io.dropwizard</groupId>
            <artifactId>dropwizard-forms</artifactId>
            <version>${dropwizard.version}</version>
        </dependency>
        <dependency>
            <groupId>io.dropwizard</groupId>
            <artifactId>dropwizard-assets</artifactId>
            <version>${dropwizard.version}</version>
        </dependency>
        <!--
          The Mustache renderer is discovered through the ViewRenderer service loader, not
          referenced in code, so mvn dependency:analyze also reports this as unused. It is
          not. Removing it compiles fine and then renders no views at runtime.
        -->
        <dependency>
            <groupId>io.dropwizard</groupId>
            <artifactId>dropwizard-views-mustache</artifactId>
            <version>${dropwizard.version}</version>
        </dependency>
        <!--
          JavaFX WebView, for the desktop app's native window (see apps/server/desktop). The
          classifier is set per-OS by the profiles at the bottom of this file. These are on the
          normal compile path so the desktop launcher compiles in every build; the server and
          Docker deployments simply never load the JavaFX classes.
        -->
        <dependency>
            <groupId>org.openjfx</groupId>
            <artifactId>javafx-base</artifactId>
            <version>${javafx.version}</version>
            <classifier>${javafx.platform}</classifier>
        </dependency>
        <dependency>
            <groupId>org.openjfx</groupId>
            <artifactId>javafx-graphics</artifactId>
            <version>${javafx.version}</version>
            <classifier>${javafx.platform}</classifier>
        </dependency>
        <dependency>
            <groupId>org.openjfx</groupId>
            <artifactId>javafx-controls</artifactId>
            <version>${javafx.version}</version>
            <classifier>${javafx.platform}</classifier>
        </dependency>
        <dependency>
            <groupId>org.openjfx</groupId>
            <artifactId>javafx-web</artifactId>
            <version>${javafx.version}</version>
            <classifier>${javafx.platform}</classifier>
        </dependency>
        <!-- javafx-web pulls javafx-media transitively; declared explicitly with the classifier
             so Maven does not resolve the empty, classifier-less jar instead. -->
        <dependency>
            <groupId>org.openjfx</groupId>
            <artifactId>javafx-media</artifactId>
            <version>${javafx.version}</version>
            <classifier>${javafx.platform}</classifier>
        </dependency>
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>5.11.4</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.junit.platform</groupId>
            <artifactId>junit-platform-suite</artifactId>
            <version>1.11.4</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>nl.jqno.equalsverifier</groupId>
            <artifactId>equalsverifier</artifactId>
            <version>3.15.8</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-site-plugin</artifactId>
                    <version>3.12.1</version>
                </plugin>
            </plugins>
        </pluginManagement>
        <plugins>
            <!--
              Builds the React frontend and embeds it in the jar, so `mvn verify` produces a
              single artifact that serves both the API and the GUI, and CI builds the GUI too.
              Previously this was a hand-run shell script that copied Vite's output into src/,
              which meant `mvn package` alone produced a jar with no GUI in it.

              Node is downloaded into target/ (not the source tree) and used only at build
              time. Pass -DskipFrontend=true to build the backend without Node installed.
            -->
            <plugin>
                <groupId>com.github.eirslett</groupId>
                <artifactId>frontend-maven-plugin</artifactId>
                <version>${frontend.plugin.version}</version>
                <configuration>
                    <workingDirectory>frontend</workingDirectory>
                    <installDirectory>${project.build.directory}</installDirectory>
                    <skip>${skipFrontend}</skip>
                </configuration>
                <executions>
                    <execution>
                        <id>install-node-and-npm</id>
                        <goals><goal>install-node-and-npm</goal></goals>
                        <configuration>
                            <nodeVersion>${frontend.node.version}</nodeVersion>
                        </configuration>
                    </execution>
                    <execution>
                        <id>npm-ci</id>
                        <goals><goal>npm</goal></goals>
                        <configuration>
                            <arguments>ci</arguments>
                        </configuration>
                    </execution>
                    <execution>
                        <id>npm-build</id>
                        <goals><goal>npm</goal></goals>
                        <configuration>
                            <arguments>run build</arguments>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!--
              Copies Vite's output onto the classpath where ReactAppResource looks for it.
              This writes into target/classes, never into src/.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.3.1</version>
                <executions>
                    <execution>
                        <id>copy-react-app</id>
                        <phase>process-resources</phase>
                        <goals><goal>copy-resources</goal></goals>
                        <configuration>
                            <skip>${skipFrontend}</skip>
                            <outputDirectory>${project.build.outputDirectory}/org/openpreservation/fixity/apps/server/webapp</outputDirectory>
                            <resources>
                                <resource>
                                    <directory>frontend/dist</directory>
                                </resource>
                            </resources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
                <version>2.4.3</version>
                <configuration>
                <createDependencyReducedPom>true</createDependencyReducedPom>
                <filters>
                    <filter>
                    <artifact>*:*</artifact>
                    <excludes>
                        <exclude>META-INF/*.SF</exclude>
                        <exclude>META-INF/*.DSA</exclude>
                        <exclude>META-INF/*.RSA</exclude>
                    </excludes>
                    </filter>
                </filters>
                </configuration>
                <executions>
                <execution>
                    <phase>package</phase>
                    <goals>
                    <goal>shade</goal>
                    </goals>
                    <configuration>
                    <transformers>
                        <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
                        <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                            <mainClass>org.openpreservation.fixity.apps.server.OpenFixityServer</mainClass>
                        </transformer>
                    </transformers>
                    </configuration>
                </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.5.2</version>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>license-maven-plugin</artifactId>
                <version>2.0.0</version>
            </plugin>
            <!--
              Bound to verify so CI enforces it. Note that `mvn package` runs BEFORE verify
              and will not trigger this; the build must be invoked as `mvn verify`.
              Threshold is Medium: Low reports mostly style, and a check nobody can keep
              green is a check everybody learns to ignore.
            -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs.version}</version>
                <configuration>
                    <effort>Max</effort>
                    <threshold>Medium</threshold>
                    <xmlOutput>true</xmlOutput>
                    <excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
                </configuration>
                <executions>
                    <execution>
                        <id>spotbugs-check</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-deploy-plugin</artifactId>
                <version>2.8.2</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.2.0</version>
                <configuration>
                    <archive>
                        <manifest>
                            <mainClass>org.openpreservation.fixity.apps.server.OpenFixityServer</mainClass>
                            <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
                        </manifest>
                    </archive>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <reporting>
        <outputDirectory>docs/site</outputDirectory>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <version>${mvn.reportsinfo.version}</version>
            </plugin>
        </plugins>
    </reporting>

    <!--
      Selects the JavaFX native bundle matching the OS and architecture of the build machine.
      jpackage cannot cross-compile, so the desktop installer is always built on its target
      platform, and these profiles activate automatically from the OS.

      Note: there is no linux-aarch64 JavaFX build on Maven Central for this version, so ARM
      Linux cannot build the native-window desktop app; it runs the server/Docker path instead.
    -->
    <profiles>
        <profile>
            <id>javafx-linux-x64</id>
            <activation><os><family>unix</family><name>Linux</name><arch>amd64</arch></os></activation>
            <properties><javafx.platform>linux</javafx.platform></properties>
        </profile>
        <profile>
            <id>javafx-mac-x64</id>
            <activation><os><family>mac</family><arch>x86_64</arch></os></activation>
            <properties><javafx.platform>mac</javafx.platform></properties>
        </profile>
        <profile>
            <id>javafx-mac-arm64</id>
            <activation><os><family>mac</family><arch>aarch64</arch></os></activation>
            <properties><javafx.platform>mac-aarch64</javafx.platform></properties>
        </profile>
        <profile>
            <id>javafx-win-x64</id>
            <activation><os><family>windows</family><arch>amd64</arch></os></activation>
            <properties><javafx.platform>win</javafx.platform></properties>
        </profile>
    </profiles>

</project>