<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.zeroturnaround</groupId>
  <artifactId>netbeans-open</artifactId>
  <version>0.9.5-SNAPSHOT</version>
  <packaging>nbm</packaging>
  
  <name>JRebel for NetBeans Installer</name>
  <description>JRebel for NetBeans Installer: JRebel is a productivity tool that allows developers to reload code changes instantly.</description>
  <url>https://www.jrebel.com/products/jrebel</url>
  
  <developers>
    <developer>
      <id>AK</id>
      <name>Ago Kuusik</name>
      <email>akuusik@perforce.com</email>
    </developer>
  </developers>

  <properties>
    <releaseVersion>${project.version}</releaseVersion>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.target>1.8</maven.compiler.target>
    <maven.compiler.source>1.8</maven.compiler.source>
    <!-- DigiCert Software Trust Manager (KeyLocker) code signing (see the "sign" profile). The .nbm is
         signed with jarsigner over PKCS#11 because nbm-maven-plugin's own signing only supports file
         keystores. Default alias is the 30-day TEST cert used for snapshot/CI builds; the "release"
         profile overrides it with the production cert (the Installer is published to the NetBeans
         plugin portal, where users verify the signature). -->
    <signing.cert.alias>Perforce-Code-Signing-General-Use-TEST-30day-Autorotating</signing.cert.alias>
    <tsa>http://timestamp.digicert.com</tsa>
    <signing.pkcs11.config>/opt/smtools/digicert-pkcs11.cfg</signing.pkcs11.config>
  </properties>

  <organization>
    <name>Perforce Software AS</name>
    <url>https://www.jrebel.com/</url>
  </organization>

  <licenses>
    <license>
      <name>The MIT License (MIT)</name>
      <url>http://www.opensource.org/licenses/mit-license.php</url>
      <distribution>repo</distribution>
    </license>
  </licenses>
  
  <scm>
    <url>https://github.com/zeroturnaround/netbeans-jrebel-open-plugin</url>
    <connection>scm:git:git@github.com:zeroturnaround/netbeans-jrebel-open-plugin.git</connection>
    <developerConnection>scm:git:git@github.com:zeroturnaround/netbeans-jrebel-open-plugin.git</developerConnection>
    <tag>HEAD</tag>
  </scm>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.netbeans.utilities</groupId>
        <artifactId>nbm-maven-plugin</artifactId>
        <version>4.5</version>
        <extensions>true</extensions>
        <configuration>
          <licenseName>MIT License (MIT)</licenseName>
          <licenseFile>${project.basedir}/LICENSE.txt</licenseFile>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.8.1</version>
        <configuration>
          <source>1.8</source>
          <target>1.8</target>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jar-plugin</artifactId>
        <version>3.1.2</version>
        <configuration>
          <archive>
            <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
          </archive>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-release-plugin</artifactId>
        <version>2.5.3</version>
        <configuration>
          <!-- "sign" added so the release build also code-signs the .nbm (PKCS#11) with the production
               cert; "release" activates GPG artifact signing + sources/javadoc jars for Maven Central.
               (javadoc is no longer skipped: Maven Central requires a -javadoc.jar for the module jar.) -->
          <releaseProfiles>release,sign</releaseProfiles>
        </configuration>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <profile>
      <id>sign</id>
      <!-- Signs the produced .nbm with the DigiCert Software Trust Manager (KeyLocker) key via
           jarsigner over PKCS#11 (nbm-maven-plugin's own signing only supports file keystores).
           Bound to pre-integration-test: after nbm:nbm (package) so the .nbm exists, and before the
           "release" profile's maven-gpg-plugin (verify) so GPG signs the already-code-signed .nbm.
           Auth is via the SM_* env vars injected by the Jenkins job and the smpkcs11.so module
           provisioned by pe-chef (digicert::smtools). Snapshot/CI builds use the TEST cert (default
           ${signing.cert.alias}); a release signs with the production cert (release profile). -->
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-jarsigner-plugin</artifactId>
            <version>3.0.0</version>
            <executions>
              <execution>
                <id>sign-nbm</id>
                <phase>pre-integration-test</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
                <configuration>
                  <!-- Sign the .nbm produced by nbm:nbm (package phase), not the module jar. -->
                  <archiveDirectory>${project.build.directory}</archiveDirectory>
                  <includes>
                    <include>*.nbm</include>
                  </includes>
                  <processMainArtifact>false</processMainArtifact>
                  <processAttachedArtifacts>false</processAttachedArtifacts>
                  <storetype>PKCS11</storetype>
                  <keystore>NONE</keystore>
                  <!-- KeyLocker authenticates via the SM_* env vars; the PKCS#11 PIN is unused, so a
                       literal "NONE" avoids an interactive passphrase prompt in non-interactive CI. -->
                  <storepass>NONE</storepass>
                  <providerClass>sun.security.pkcs11.SunPKCS11</providerClass>
                  <providerArg>${signing.pkcs11.config}</providerArg>
                  <alias>${signing.cert.alias}</alias>
                  <tsa>${tsa}</tsa>
                  <arguments>
                    <argument>-digestalg</argument>
                    <argument>SHA-256</argument>
                    <argument>-sigalg</argument>
                    <argument>SHA256withRSA</argument>
                    <argument>-tsadigestalg</argument>
                    <argument>SHA-256</argument>
                  </arguments>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>release</id>
      <properties>
        <!-- Released Installer .nbm (published to the NetBeans plugin portal) is code-signed with the
             production certificate. Activated alongside the "sign" profile via the release plugin's
             releaseProfiles, so it just overrides the (TEST) default alias. -->
        <signing.cert.alias>Perforce-Code-Signing-General-Use-Prod-2026</signing.cert.alias>
      </properties>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <!-- Maven Central requires a -sources.jar for the published module jar. -->
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <version>3.3.1</version>
            <executions>
              <execution>
                <id>attach-sources</id>
                <phase>package</phase>
                <goals>
                  <goal>jar-no-fork</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <!-- Maven Central requires a -javadoc.jar; it only checks that the jar exists, not its
                 contents. doclint=none + failOnError=false + quiet guarantee the jar is produced even
                 if the (minimal) installer sources have imperfect/no javadoc, so the release won't fail
                 on javadoc lint. -->
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <version>3.11.2</version>
            <configuration>
              <doclint>none</doclint>
              <failOnError>false</failOnError>
              <quiet>true</quiet>
            </configuration>
            <executions>
              <execution>
                <id>attach-javadocs</id>
                <phase>package</phase>
                <goals>
                  <goal>jar</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>

  <dependencies>
    <dependency>
      <groupId>org.netbeans.api</groupId>
      <artifactId>org-netbeans-modules-autoupdate-services</artifactId>
      <version>RELEASE110</version>
    </dependency>
    <dependency>
      <groupId>org.netbeans.api</groupId>
      <artifactId>org-netbeans-modules-autoupdate-ui</artifactId>
      <version>RELEASE110</version>
    </dependency>
    <dependency>
      <groupId>org.netbeans.api</groupId>
      <artifactId>org-netbeans-api-progress</artifactId>
      <version>RELEASE110</version>
    </dependency>
    <dependency>
      <groupId>org.netbeans.api</groupId>
      <artifactId>org-netbeans-api-annotations-common</artifactId>
      <version>RELEASE110</version>
    </dependency>
    <dependency>
      <groupId>org.netbeans.api</groupId>
      <artifactId>org-openide-modules</artifactId>
      <version>RELEASE110</version>
    </dependency>
    <dependency>
      <groupId>org.netbeans.api</groupId>
      <artifactId>org-openide-util</artifactId>
      <version>RELEASE110</version>
    </dependency>
    <dependency>
      <groupId>org.netbeans.api</groupId>
      <artifactId>org-openide-util-ui</artifactId>
      <version>RELEASE110</version>
    </dependency>
  </dependencies>

  <distributionManagement>
    <!-- Sonatype OSSRH (oss.sonatype.org) was shut down 2025-06-30; this mirrors the
         gradle-jrebel-plugin migration.
         Releases -> OSSRH Staging API compatibility service (stages, then published from the Portal UI
         -> syncs to repo1.maven.org, where the NetBeans plugin portal points). Uses the existing
         Sonatype credentials via the unchanged sonatype-nexus-staging server in settings.xml.
         Snapshots -> internal zt-public-snapshots, NOT Maven Central: SNAPSHOT publishing is not
         enabled for the org.zeroturnaround namespace on the Central Portal (see gradle-jrebel-plugin,
         which routes snapshots the same way). Installer snapshots are dev-only; only releases are
         portal-facing. Server id zt-public-snapshots already exists in the node's settings.xml. -->
    <repository>
      <id>sonatype-nexus-staging</id>
      <name>Central Portal (OSSRH Staging API)</name>
      <url>https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2</url>
    </repository>
    <snapshotRepository>
      <id>zt-public-snapshots</id>
      <name>ZeroTurnaround Public Snapshots</name>
      <url>https://repos.zeroturnaround.com/nexus/content/repositories/zt-public-snapshots/</url>
    </snapshotRepository>
  </distributionManagement>
</project>