<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

  <modelVersion>4.0.0</modelVersion>

  <groupId>se.litsec.sweid.idp</groupId>
  <artifactId>shibboleth-base-dependency-bom</artifactId>
  <packaging>pom</packaging>
  <version>1.8.0</version>

  <name>Swedish eID :: Dependency BOM :: Shibboleth IdP base dependencies</name>
  <description>BOM (Bill of Materials) for dependencies for users of the base packaging of Shibboleth IdP 3.X for the Swedish eID Framework</description>
  <url>https://github.com/litsec/swedish-eid-shibboleth-base</url>

  <licenses>
    <license>
      <name>The Apache Software License, Version 2.0</name>
      <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <scm>
    <connection>scm:git:https://github.com/litsec/swedish-eid-shibboleth-base.git</connection>
    <developerConnection>scm:git:https://github.com/litsec/swedish-eid-shibboleth-base.git</developerConnection>
    <url>https://github.com/litsec/swedish-eid-shibboleth-base/tree/master</url>
  </scm>

  <developers>
    <developer>
      <name>Martin Lindström</name>
      <email>martin.lindstrom@litsec.se</email>
      <organization>Litsec AB</organization>
      <organizationUrl>http://www.litsec.se</organizationUrl>
    </developer>
  </developers>

  <organization>
    <name>Litsec AB</name>
    <url>http://www.litsec.se</url>
  </organization>

  <properties>
    <opensaml.version>3.4.5</opensaml.version>
    <opensaml-security-ext.version>1.0.7</opensaml-security-ext.version>
    <opensaml-ext.version>1.4.5</opensaml-ext.version>
    <opensaml.swedish-eid.version>1.4.0</opensaml.swedish-eid.version>

    <shibboleth.version>3.4.6</shibboleth.version>
    <shibboleth.java-support.version>7.5.1</shibboleth.java-support.version>
    <shibboleth.spring-extensions.version>5.4.1</shibboleth.spring-extensions.version>

    <spring.version>4.3.19.RELEASE</spring.version>

    <!-- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-72470 -->
    <spring-web.version>4.3.20.RELEASE</spring-web.version>

    <spring.webflow.version>2.4.8.RELEASE</spring.webflow.version>
    <spring.mobile.version>1.1.5.RELEASE</spring.mobile.version>

    <jackson.version>2.13.1</jackson.version>

    <slf4j.version>1.7.25</slf4j.version>
    <junit.version>4.13.2</junit.version>
  </properties>

  <repositories>
    <repository>
      <id>central</id>
      <name>Maven Central</name>
      <url>https://repo1.maven.org/maven2/</url>
    </repository>
    <repository>
      <id>shibboleth</id>
      <name>Shibboleth Maven Repo</name>
      <url>https://build.shibboleth.net/nexus/content/repositories/releases</url>
    </repository>
    <repository>
      <id>spring-repo</id>
      <name>Spring Repository</name>
      <url>http://repo.spring.io/release</url>
    </repository>
  </repositories>

  <distributionManagement>
    <snapshotRepository>
      <id>ossrh</id>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
    </snapshotRepository>
    <repository>
      <id>ossrh</id>
      <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
    </repository>
  </distributionManagement>

  <dependencyManagement>

    <dependencies>

      <dependency>
        <groupId>se.swedenconnect.opensaml</groupId>
        <artifactId>opensaml-bom</artifactId>
        <version>${opensaml.version}.R2</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <!-- Java EE -->
      <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>3.1.0</version>
        <scope>provided</scope>
      </dependency>

      <!-- JSTL -->
      <dependency>
        <groupId>org.apache.taglibs</groupId>
        <artifactId>taglibs-standard-spec</artifactId>
        <version>1.2.5</version>
      </dependency>

      <dependency>
        <groupId>org.apache.taglibs</groupId>
        <artifactId>taglibs-standard-impl</artifactId>
        <version>1.2.5</version>
      </dependency>

      <!-- OpenSAML extensions -->
      <dependency>
        <groupId>se.swedenconnect.opensaml</groupId>
        <artifactId>opensaml-security-ext</artifactId>
        <version>${opensaml-security-ext.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>se.litsec.opensaml</groupId>
        <artifactId>opensaml3-ext</artifactId>
        <version>${opensaml-ext.version}</version>
        <type>jar</type>
        <scope>provided</scope>
        <exclusions>
          <exclusion>
            <groupId>se.swedenconnect.opensaml</groupId>
            <artifactId>opensaml-security-ext</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>se.litsec.opensaml.sweid</groupId>
        <artifactId>swedish-eid-opensaml3</artifactId>
        <version>${opensaml.swedish-eid.version}</version>
        <type>jar</type>
        <scope>provided</scope>
        <exclusions>
          <exclusion>
            <groupId>se.swedenconnect.opensaml</groupId>
            <artifactId>opensaml-security-ext</artifactId>
          </exclusion>
          <exclusion>
            <groupId>se.litsec.opensaml</groupId>
            <artifactId>opensaml3-ext</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <!-- Mark all OpenSAML dependencies as provided -->
      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-core</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-messaging-api</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-messaging-impl</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-profile-api</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-profile-impl</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-saml-api</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-saml-impl</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-security-api</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-security-impl</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-soap-api</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-soap-impl</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-storage-api</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-storage-impl</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-xmlsec-api</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.opensaml</groupId>
        <artifactId>opensaml-xmlsec-impl</artifactId>
        <version>${opensaml.version}</version>
        <scope>provided</scope>
      </dependency>

      <!-- Shibboleth -->
      <dependency>
        <groupId>net.shibboleth.utilities</groupId>
        <artifactId>java-support</artifactId>
        <version>${shibboleth.java-support.version}</version>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.ext</groupId>
        <artifactId>spring-extensions</artifactId>
        <version>${shibboleth.spring-extensions.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-core</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-schema</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-admin-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-authn-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
        <exclusions>
          <exclusion>
            <groupId>org.apache.velocity</groupId>
            <artifactId>velocity</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-attribute-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-attribute-resolver-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-attribute-filter-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-cas-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-profile-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-saml-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-session-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-consent-api</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-admin-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-authn-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
        <exclusions>
          <!-- https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078 -->
          <exclusion>
            <groupId>org.apache.velocity</groupId>
            <artifactId>velocity</artifactId>
          </exclusion>
          <!-- DuoWeb is delivered in the Shibboleth lib package. But it seems like it isn't published to any official Maven repos. We exclude it from the dependencies 
            so that everyone can build ... -->
          <exclusion>
            <groupId>com.duosecurity</groupId>
            <artifactId>DuoWeb</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-attribute-resolver-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
        <exclusions>
          <!-- https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078 -->
          <exclusion>
            <groupId>org.apache.velocity</groupId>
            <artifactId>velocity</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-attribute-filter-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-cas-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-profile-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-profile-spring</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-saml-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-session-impl</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-attribute-resolver-spring</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-attribute-filter-spring</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-consent-impl</artifactId>
        <version>${shibboleth.version}</version>
      </dependency>

      <dependency>
        <groupId>net.shibboleth.idp</groupId>
        <artifactId>idp-ui</artifactId>
        <version>${shibboleth.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <!-- Spring -->
      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context-support</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-beans</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-aop</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-web</artifactId>
        <version>${spring-web.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-expression</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-jdbc</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework.webflow</groupId>
        <artifactId>spring-webflow</artifactId>
        <version>${spring.webflow.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework.webflow</groupId>
        <artifactId>spring-binding</artifactId>
        <version>${spring.webflow.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework.mobile</groupId>
        <artifactId>spring-mobile-device</artifactId>
        <version>${spring.mobile.version}</version>
        <type>jar</type>
        <scope>provided</scope>
        <exclusions>
          <exclusion>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
          </exclusion>
          <exclusion>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
          </exclusion>
        </exclusions>
      </dependency>

      <!-- Jackson -->
      <!-- Shibboleth uses Jackson 2.8.3. This version has reported vulnerabilities, so we change this ... -->
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>${jackson.version}</version>
        <scope>provided</scope>
        <type>jar</type>
      </dependency>

      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-annotations</artifactId>
        <version>${jackson.version}</version>
        <scope>provided</scope>
        <type>jar</type>
      </dependency>

      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>${jackson.version}</version>
        <scope>provided</scope>
        <type>jar</type>
      </dependency>

      <dependency>
        <groupId>com.fasterxml.jackson.datatype</groupId>
        <artifactId>jackson-datatype-joda</artifactId>
        <version>${jackson.version}</version>
        <scope>provided</scope>
        <type>jar</type>
      </dependency>

      <!-- Misc -->
      <dependency>
        <groupId>joda-time</groupId>
        <artifactId>joda-time</artifactId>
        <version>2.9</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <dependency>
        <groupId>commons-lang</groupId>
        <artifactId>commons-lang</artifactId>
        <version>2.4</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <!-- For logging -->
      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>${slf4j.version}</version>
        <type>jar</type>
        <scope>provided</scope>
      </dependency>

      <!-- For testing -->
      <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>${junit.version}</version>
        <type>jar</type>
        <scope>test</scope>
      </dependency>

      <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-test</artifactId>
        <version>${spring.version}</version>
        <type>jar</type>
        <scope>test</scope>
      </dependency>

      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-log4j12</artifactId>
        <version>${slf4j.version}</version>
        <type>jar</type>
        <scope>test</scope>
      </dependency>

      <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-simple</artifactId>
        <version>${slf4j.version}</version>
        <scope>test</scope>
        <type>jar</type>
      </dependency>

    </dependencies>

  </dependencyManagement>

  <profiles>
    <profile>
      <id>release</id>

      <build>
        <plugins>

          <plugin>
            <groupId>org.sonatype.plugins</groupId>
            <artifactId>nexus-staging-maven-plugin</artifactId>
            <version>1.6.7</version>
            <extensions>true</extensions>
            <configuration>
              <serverId>ossrh</serverId>
              <nexusUrl>https://oss.sonatype.org/</nexusUrl>
              <autoReleaseAfterClose>false</autoReleaseAfterClose>
              <!-- Allows manual inspection of the staging repo before deploying it to the central repo. Use 'mvn nexus-staging:release -Prelease' to release and 
                'mvn nexus-staging:drop' to abort. -->
            </configuration>
          </plugin>

          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>1.6</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
          </plugin>

        </plugins>
      </build>

    </profile>
  </profiles>

</project>