From 52618b7031cb6a58b55d2fda6ab7baac2da0e880 Mon Sep 17 00:00:00 2001
From: Guillaume Nodet <gnodet@gmail.com>
Date: Tue, 15 Oct 2024 16:02:38 +0200
Subject: [PATCH 1/6] [MNG-8312] Generate the BOM automatically

---
 maven-bom/pom.xml | 209 ----------------------------------------------
 pom.xml           |  33 +++++++-
 2 files changed, 31 insertions(+), 211 deletions(-)
 delete mode 100644 maven-bom/pom.xml

diff --git a/maven-bom/pom.xml b/maven-bom/pom.xml
deleted file mode 100644
index 164027d419c9..000000000000
--- a/maven-bom/pom.xml
+++ /dev/null
@@ -1,209 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-Licensed to the Apache Software Foundation (ASF) under one
-or more contributor license agreements.  See the NOTICE file
-distributed with this work for additional information
-regarding copyright ownership.  The ASF licenses this file
-to you under the Apache License, Version 2.0 (the
-"License"); you may not use this file except in compliance
-with the License.  You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing,
-software distributed under the License is distributed on an
-"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-KIND, either express or implied.  See the License for the
-specific language governing permissions and limitations
-under the License.
--->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
-  <modelVersion>4.0.0</modelVersion>
-  <parent>
-    <groupId>org.apache</groupId>
-    <artifactId>apache</artifactId>
-    <version>33</version>
-    <relativePath />
-  </parent>
-
-  <groupId>org.apache.maven</groupId>
-  <artifactId>maven-bom</artifactId>
-  <version>4.0.0-beta-5-SNAPSHOT</version>
-  <packaging>pom</packaging>
-
-  <name>Maven Dependencies BOM</name>
-  <description>Bill Of Materials for Apache Maven dependencies</description>
-  <url>https://maven.apache.org/ref/${project.version}/${project.artifactId}</url>
-
-  <scm>
-    <connection>scm:git:https://gitbox.apache.org/repos/asf/maven.git</connection>
-    <developerConnection>scm:git:https://gitbox.apache.org/repos/asf/maven.git</developerConnection>
-    <tag>maven-4.0.0-beta-3</tag>
-    <url>https://github.com/apache/maven/tree/${project.scm.tag}/${project.artifactId}</url>
-  </scm>
-  <issueManagement>
-    <system>jira</system>
-    <url>https://issues.apache.org/jira/browse/MNG</url>
-  </issueManagement>
-  <ciManagement>
-    <system>Jenkins</system>
-    <url>https://ci-maven.apache.org/job/Maven/job/maven-box/job/maven/</url>
-  </ciManagement>
-  <distributionManagement>
-    <site>
-      <id>apache.website</id>
-      <url>scm:svn:https://svn.apache.org/repos/asf/maven/website/components/${maven.site.path}</url>
-    </site>
-    <downloadUrl>https://maven.apache.org/download.html</downloadUrl>
-  </distributionManagement>
-
-  <properties>
-    <maven.site.path>ref/4-LATEST/${project.artifactId}</maven.site.path>
-  </properties>
-
-  <dependencyManagement>
-    <!-- Not included:
-         - apache-maven, as it delivers the binaries
-         - maven-compat, only used by apache-maven distributions to support older releases
-         - maven-slf4j-provider, only used by apache-maven distributions
-         - maven-wrapper, only used by apache-maven-wrapper distributions -->
-    <dependencies>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-artifact</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-builder-support</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-core</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-embedder</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-model</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-core</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-meta</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-model</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-settings</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-spi</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-toolchain</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-plugin</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-api-xml</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-model-builder</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-plugin-api</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-repository-metadata</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-resolver-provider</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-settings</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-settings-builder</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-toolchain-model</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-toolchain-builder</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-logging</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-      <dependency>
-        <groupId>org.apache.maven</groupId>
-        <artifactId>maven-xml-impl</artifactId>
-        <version>${project.version}</version>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
-
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-site-plugin</artifactId>
-        <configuration>
-          <topSiteURL>${project.distributionManagement.site.url}/..</topSiteURL>
-        </configuration>
-      </plugin>
-      <plugin>
-        <groupId>org.apache.rat</groupId>
-        <artifactId>apache-rat-plugin</artifactId>
-        <executions>
-          <execution>
-            <id>rat-check</id>
-            <phase>none</phase>
-          </execution>
-        </executions>
-      </plugin>
-    </plugins>
-  </build>
-</project>
diff --git a/pom.xml b/pom.xml
index 7ca7b86abf65..c0867bc19d90 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@ under the License.
   <parent>
     <groupId>org.apache.maven</groupId>
     <artifactId>maven-parent</artifactId>
-    <!-- when upgrading parent, also upgrade maven-bom's parent -->
+    <!-- when upgrading parent, also upgrade ${apacheVersion} -->
     <version>43</version>
     <relativePath />
   </parent>
@@ -122,7 +122,6 @@ under the License.
     <module>apache-maven</module>
     <module>maven-toolchain-model</module>
     <module>maven-toolchain-builder</module>
-    <module>maven-bom</module>
     <module>maven-docgen</module>
   </modules>
 
@@ -163,6 +162,7 @@ under the License.
     <maven.site.path>ref/4-LATEST</maven.site.path>
     <project.build.outputTimestamp>2024-08-30T12:59:00Z</project.build.outputTimestamp>
     <!-- various versions -->
+    <apacheVersion>33</apacheVersion>
     <assertjVersion>3.26.3</assertjVersion>
     <asmVersion>9.7.1</asmVersion>
     <byteBuddyVersion>1.15.4</byteBuddyVersion>
@@ -668,6 +668,12 @@ under the License.
         <artifactId>byte-buddy</artifactId>
         <version>${byteBuddyVersion}</version>
       </dependency>
+      <dependency>
+        <groupId>org.apache</groupId>
+        <artifactId>apache</artifactId>
+        <version>${apacheVersion}</version>
+        <type>pom</type>
+      </dependency>
     </dependencies>
     <!--bootstrap-start-comment-->
   </dependencyManagement>
@@ -856,6 +862,29 @@ under the License.</licenseText>
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>eu.maveniverse.maven.plugins</groupId>
+        <artifactId>bom-builder3</artifactId>
+        <version>1.0.0</version>
+        <executions>
+          <execution>
+            <id>skinny-bom</id>
+            <goals>
+              <goal>build-bom</goal>
+            </goals>
+            <configuration>
+              <bomGroupId>org.apache.maven</bomGroupId>
+              <bomArtifactId>maven-bom</bomArtifactId>
+              <bomVersion>${project.version}</bomVersion>
+              <bomName>Maven Dependencies BOM</bomName>
+              <bomDescription>Bill Of Materials for Apache Maven dependencies</bomDescription>
+              <bomParentGav>org.apache:apache:${apacheVersion}</bomParentGav>
+              <outputFilename>maven-bom.xml</outputFilename>
+              <attach>true</attach>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>
 

From c1721f9e93d0f7a57d106b85f0fc8e6ace0c3d9c Mon Sep 17 00:00:00 2001
From: Guillaume Nodet <gnodet@gmail.com>
Date: Wed, 16 Oct 2024 22:51:00 +0200
Subject: [PATCH 2/6] Remove BOM parent

---
 pom.xml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/pom.xml b/pom.xml
index c0867bc19d90..ae4a83169040 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,6 @@ under the License.
   <parent>
     <groupId>org.apache.maven</groupId>
     <artifactId>maven-parent</artifactId>
-    <!-- when upgrading parent, also upgrade ${apacheVersion} -->
     <version>43</version>
     <relativePath />
   </parent>
@@ -162,7 +161,6 @@ under the License.
     <maven.site.path>ref/4-LATEST</maven.site.path>
     <project.build.outputTimestamp>2024-08-30T12:59:00Z</project.build.outputTimestamp>
     <!-- various versions -->
-    <apacheVersion>33</apacheVersion>
     <assertjVersion>3.26.3</assertjVersion>
     <asmVersion>9.7.1</asmVersion>
     <byteBuddyVersion>1.15.4</byteBuddyVersion>
@@ -668,12 +666,6 @@ under the License.
         <artifactId>byte-buddy</artifactId>
         <version>${byteBuddyVersion}</version>
       </dependency>
-      <dependency>
-        <groupId>org.apache</groupId>
-        <artifactId>apache</artifactId>
-        <version>${apacheVersion}</version>
-        <type>pom</type>
-      </dependency>
     </dependencies>
     <!--bootstrap-start-comment-->
   </dependencyManagement>
@@ -878,7 +870,6 @@ under the License.</licenseText>
               <bomVersion>${project.version}</bomVersion>
               <bomName>Maven Dependencies BOM</bomName>
               <bomDescription>Bill Of Materials for Apache Maven dependencies</bomDescription>
-              <bomParentGav>org.apache:apache:${apacheVersion}</bomParentGav>
               <outputFilename>maven-bom.xml</outputFilename>
               <attach>true</attach>
             </configuration>

From 2dc7f85e101025ea12b913f9df0052f4a4aca764 Mon Sep 17 00:00:00 2001
From: Guillaume Nodet <gnodet@gmail.com>
Date: Thu, 17 Oct 2024 10:47:21 +0200
Subject: [PATCH 3/6] Generate both skinny and fat BOMs

---
 apache-maven/pom.xml | 40 ++++++++++++++++++++++++++++++++++++++++
 pom.xml              | 22 ----------------------
 2 files changed, 40 insertions(+), 22 deletions(-)

diff --git a/apache-maven/pom.xml b/apache-maven/pom.xml
index 857e2d88cc14..54cc9164c779 100644
--- a/apache-maven/pom.xml
+++ b/apache-maven/pom.xml
@@ -220,6 +220,46 @@ under the License.
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>eu.maveniverse.maven.plugins</groupId>
+        <artifactId>bom-builder3</artifactId>
+        <version>1.0.0</version>
+        <executions>
+          <execution>
+            <id>skinny-bom</id>
+            <goals>
+              <goal>build-bom</goal>
+            </goals>
+            <configuration>
+              <bomGroupId>org.apache.maven</bomGroupId>
+              <bomArtifactId>maven-bom</bomArtifactId>
+              <bomVersion>${project.version}</bomVersion>
+              <bomName>Maven Dependencies BOM</bomName>
+              <bomClassifier>skinny</bomClassifier>
+              <bomDescription>Bill Of Materials for Apache Maven - Maven JARS only</bomDescription>
+              <outputFilename>maven-skinny-bom.xml</outputFilename>
+              <attach>true</attach>
+            </configuration>
+          </execution>
+          <execution>
+            <id>fat-bom</id>
+            <goals>
+              <goal>build-bom</goal>
+            </goals>
+            <configuration>
+              <bomGroupId>org.apache.maven</bomGroupId>
+              <bomArtifactId>maven-bom</bomArtifactId>
+              <bomVersion>${project.version}</bomVersion>
+              <bomName>Maven Dependencies BOM</bomName>
+              <bomClassifier>fat</bomClassifier>
+              <bomDescription>Bill Of Materials for Apache Maven - All dependencies</bomDescription>
+              <outputFilename>maven-fat-bom.xml</outputFilename>
+              <useDependencies>true</useDependencies>
+              <attach>true</attach>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
     </plugins>
   </build>
 
diff --git a/pom.xml b/pom.xml
index ae4a83169040..2642063ab94f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -854,28 +854,6 @@ under the License.</licenseText>
           </execution>
         </executions>
       </plugin>
-      <plugin>
-        <groupId>eu.maveniverse.maven.plugins</groupId>
-        <artifactId>bom-builder3</artifactId>
-        <version>1.0.0</version>
-        <executions>
-          <execution>
-            <id>skinny-bom</id>
-            <goals>
-              <goal>build-bom</goal>
-            </goals>
-            <configuration>
-              <bomGroupId>org.apache.maven</bomGroupId>
-              <bomArtifactId>maven-bom</bomArtifactId>
-              <bomVersion>${project.version}</bomVersion>
-              <bomName>Maven Dependencies BOM</bomName>
-              <bomDescription>Bill Of Materials for Apache Maven dependencies</bomDescription>
-              <outputFilename>maven-bom.xml</outputFilename>
-              <attach>true</attach>
-            </configuration>
-          </execution>
-        </executions>
-      </plugin>
     </plugins>
   </build>
 

From b4fc469f194387da4fe43b3a9130b250f3217de8 Mon Sep 17 00:00:00 2001
From: Guillaume Nodet <gnodet@gmail.com>
Date: Thu, 17 Oct 2024 15:32:18 +0200
Subject: [PATCH 4/6] Fix deployment

---
 apache-maven/pom.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/apache-maven/pom.xml b/apache-maven/pom.xml
index 54cc9164c779..5a7d92e9ba37 100644
--- a/apache-maven/pom.xml
+++ b/apache-maven/pom.xml
@@ -223,7 +223,7 @@ under the License.
       <plugin>
         <groupId>eu.maveniverse.maven.plugins</groupId>
         <artifactId>bom-builder3</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1</version>
         <executions>
           <execution>
             <id>skinny-bom</id>
@@ -234,8 +234,8 @@ under the License.
               <bomGroupId>org.apache.maven</bomGroupId>
               <bomArtifactId>maven-bom</bomArtifactId>
               <bomVersion>${project.version}</bomVersion>
-              <bomName>Maven Dependencies BOM</bomName>
               <bomClassifier>skinny</bomClassifier>
+              <bomName>Maven Dependencies Skinny BOM</bomName>
               <bomDescription>Bill Of Materials for Apache Maven - Maven JARS only</bomDescription>
               <outputFilename>maven-skinny-bom.xml</outputFilename>
               <attach>true</attach>
@@ -250,7 +250,7 @@ under the License.
               <bomGroupId>org.apache.maven</bomGroupId>
               <bomArtifactId>maven-bom</bomArtifactId>
               <bomVersion>${project.version}</bomVersion>
-              <bomName>Maven Dependencies BOM</bomName>
+              <bomName>Maven Dependencies Fat BOM</bomName>
               <bomClassifier>fat</bomClassifier>
               <bomDescription>Bill Of Materials for Apache Maven - All dependencies</bomDescription>
               <outputFilename>maven-fat-bom.xml</outputFilename>

From 48e83ea42e2c99164d0b5f67c16af463cf34829a Mon Sep 17 00:00:00 2001
From: Tamas Cservenak <tamas@cservenak.net>
Date: Thu, 17 Oct 2024 16:15:01 +0200
Subject: [PATCH 5/6] Import w/ classifier

Only from Model 4.1.0+
---
 .../impl/model/DefaultModelValidator.java         | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/maven-api-impl/src/main/java/org/apache/maven/internal/impl/model/DefaultModelValidator.java b/maven-api-impl/src/main/java/org/apache/maven/internal/impl/model/DefaultModelValidator.java
index 8867a8257357..56f3fde5f3f4 100644
--- a/maven-api-impl/src/main/java/org/apache/maven/internal/impl/model/DefaultModelValidator.java
+++ b/maven-api-impl/src/main/java/org/apache/maven/internal/impl/model/DefaultModelValidator.java
@@ -471,7 +471,13 @@ public void validateFileModel(
             }
 
             validate20RawDependencies(
-                    problems, m.getDependencies(), "dependencies.dependency.", EMPTY, validationLevel, request);
+                    problems,
+                    m.getDependencies(),
+                    "dependencies.dependency.",
+                    EMPTY,
+                    isModelVersion41OrMore,
+                    validationLevel,
+                    request);
 
             validate20RawDependenciesSelfReferencing(
                     problems, m, m.getDependencies(), "dependencies.dependency", request);
@@ -482,6 +488,7 @@ public void validateFileModel(
                         m.getDependencyManagement().getDependencies(),
                         "dependencyManagement.dependencies.dependency.",
                         EMPTY,
+                        isModelVersion41OrMore,
                         validationLevel,
                         request);
             }
@@ -539,6 +546,7 @@ public void validateFileModel(
                         profile.getDependencies(),
                         prefix,
                         "dependencies.dependency.",
+                        isModelVersion41OrMore,
                         validationLevel,
                         request);
 
@@ -548,6 +556,7 @@ public void validateFileModel(
                             profile.getDependencyManagement().getDependencies(),
                             prefix,
                             "dependencyManagement.dependencies.dependency.",
+                            isModelVersion41OrMore,
                             validationLevel,
                             request);
                 }
@@ -982,6 +991,7 @@ private void validate20RawDependencies(
             List<Dependency> dependencies,
             String prefix,
             String prefix2,
+            boolean is41OrBeyond,
             int validationLevel,
             ModelBuilderRequest request) {
         Severity errOn30 = getSeverity(validationLevel, ModelValidator.VALIDATION_LEVEL_MAVEN_3_0);
@@ -1002,7 +1012,8 @@ private void validate20RawDependencies(
                             key,
                             "must be 'pom' to import the managed dependencies.",
                             dependency);
-                } else if (dependency.getClassifier() != null
+                } else if (!is41OrBeyond
+                        && dependency.getClassifier() != null
                         && !dependency.getClassifier().isEmpty()) {
                     addViolation(
                             problems,

From 1f099f0f790bd0886e32ba8f9d77fd75abc709e1 Mon Sep 17 00:00:00 2001
From: Guillaume Nodet <gnodet@gmail.com>
Date: Thu, 17 Oct 2024 16:46:33 +0200
Subject: [PATCH 6/6] Keep same order for elements

---
 apache-maven/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apache-maven/pom.xml b/apache-maven/pom.xml
index 5a7d92e9ba37..d46aa209cd43 100644
--- a/apache-maven/pom.xml
+++ b/apache-maven/pom.xml
@@ -250,8 +250,8 @@ under the License.
               <bomGroupId>org.apache.maven</bomGroupId>
               <bomArtifactId>maven-bom</bomArtifactId>
               <bomVersion>${project.version}</bomVersion>
-              <bomName>Maven Dependencies Fat BOM</bomName>
               <bomClassifier>fat</bomClassifier>
+              <bomName>Maven Dependencies Fat BOM</bomName>
               <bomDescription>Bill Of Materials for Apache Maven - All dependencies</bomDescription>
               <outputFilename>maven-fat-bom.xml</outputFilename>
               <useDependencies>true</useDependencies>