[hj690]

Context

MOSS requires that we build and release this repo with dependencies only from Airlock (maven-3p-trusted), not from Maven Central. This PR fixes the repository-side plugin blockers for that goal (b/572892413).

Problem

There are 4 legacy build-plugin artifacts have no valid license, and rejected by Airlock:

• plexus-components:1.1.4 and classworlds:1.1-alpha-2 — pulled in by clirr-maven-plugin:2.8 (clirr-compatibility-check profile is active on every JDK ≥ 1.8, and -Dclirr.skip=true does not stop plugin resolution).
• plexus-i18n:1.0-beta-7 — pulled in by findbugs-maven-plugin:3.0.5 and maven-bundle-plugin:5.1.9 through doxia-site-renderer.
• antlr:2.7.2 — pulled in by findbugs-maven-plugin:3.0.5 → velocity-tools → struts-core.

Fix

• pom.xml and .kokoro/build.sh: make the clirr-compatibility-check profile opt-in. The CLIRR job in .kokoro/build.sh now enables it with -P=clirr-compatibility-check. The release scripts already pass -P=-clirr-compatibility-check, so they do not change.
• pom.xml (pluginManagement): in findbugs-maven-plugin, override antlr to 2.7.7 and plexus-i18n to 1.0-beta-10.
• pom.xml (pluginManagement): in maven-bundle-plugin, override plexus-i18n to 1.0-beta-10.
• The plexus-i18n overrides exclude all transitive dependencies (*:*). The parent POM of plexus-i18n adds old Plexus container JARs that Airlock does not have, and Maven core already provides those classes.

No published module POMs or runtime dependencies are modified.

Testing and verification

• The .class files and OSGi manifests of all release artifacts are byte-identical to main. Only the root pom.xml changes.
• mvn install with tests passes on JDK 17: 738 tests, 0 failures, 2 skipped.
• The CLIRR job command, mvn -P=clirr-compatibility-check clirr:check, still passes with 0 errors in 11 modules.

[lqiu96]

qq, this looks to be adding in a new plugin? Is this intended? Do we need maven-bundle-plugin?

[blakeli0]

I think maven-bundle-plugin is used in multiple sub-modules, and this is supposed to be the parent that override dependencies.

That being said, I think we should remove the version declaration in submodules (e.g. here) so it is less confusing.

[hj690]

Thank you both for the review!

@lqiu96 , yes as Blake mentioned, maven-bundle-plugin is already used by google-http-client, google-http-client-apache-v2, and google-http-client-apache-v5, adding this in the root pom.xml lets the parent POM centrally override its transitive plexus-i18n dependency (1.0-beta-7 -> 1.0-beta-10) without repeating the override in all three modules.

Thanks for the suggestion @BlakeLi, I updated in a9559fa to remove the duplicate <version>5.1.9</version> declarations from the three child pom.xml files so they inherit the version from the parent <pluginManagement>.

[lqiu96]

LGTM, ty