JVCN Maven Plugin

vChain Code Notary Dependency verification

License	GPL-v3.0
Categories	Maven Build Tools
GroupId	us.vchain
ArtifactId	jvcn-maven-plugin
Last Version	0.0.1
Release Date	May 21, 2019
Type	maven-plugin
Description	JVCN Maven Plugin vChain Code Notary Dependency verification
Project URL	https://www.codenotary.io
Project Organization	vChain
Source Code Management	https://github.com/vchain-us/jvcn-maven-plugin/tree/master

Download jvcn-maven-plugin

Filename	Size
jvcn-maven-plugin-0.0.1.pom
jvcn-maven-plugin-0.0.1.jar	19 KB
jvcn-maven-plugin-0.0.1-sources.jar	10 KB
jvcn-maven-plugin-0.0.1-javadoc.jar	395 KB

How to add to project

Apache Maven

<plugin>
    <groupId>us.vchain</groupId>
    <artifactId>jvcn-maven-plugin</artifactId>
    <version>0.0.1</version>
</plugin>

Dependencies

compile (2)

Group / Artifact	Type	Version
us.vchain : jvcn	jar	0.0.1
org.apache.maven.shared : maven-dependency-tree	jar	3.0.1

provided (4)

Group / Artifact	Type	Version
org.apache.maven : maven-plugin-api	jar	3.3.9
org.apache.maven : maven-core	jar	3.3.9
org.apache.maven : maven-artifact	jar	3.3.9
org.apache.maven.plugin-tools : maven-plugin-annotations	jar	3.6.0

test (3)

Group / Artifact	Type	Version
junit : junit	jar	4.12
org.apache.maven : maven-compat	jar	3.3.9
org.apache.maven.plugin-testing : maven-plugin-testing-harness	jar	3.3.0

Project Modules

There are no modules declared in this project.

JVCN Maven Plugin

Maven dependency verification & enforcement via the vChain Code Notary platform.

This package provides a maven plugin for verifying the integrity of your project dependencies through code notary.

License

This software is released under GPL3.

Usage

Add the plugin dependency to your maven project

<build>
   ...
   <plugins>
      ...
      <plugin>
         <groupId>us.vchain</groupId>
         <artifactId>jvcn-maven-plugin</artifactId>
         <version>0.0.1</version>
         <executions>
            <execution>
               <id>audit</id>
               <phase>validate</phase>
               <goals>
                  <goal>audit</goal>
               </goals>
            </execution>
         </executions>
      </plugin>
      ... 
   </plugins>
   ...
</build>

Notarize your dependencies

If the build fails stating that some (or all) dependencies could not be verified, perform the following steps to notarize them:

1. Download the dependencies JARs from the Maven repository to your machine
2. Navigate to the CodeNotary dashboard, create an account if you don't already have one and sign each JAR.
3. Re-run the build. This time all dependencies should be reported as trusted and the build should succeed again.

Plugin configuration

The plugin provides some configuration options:

failOnError (default: true)

Fails the maven build if a single dependency is not signed with the status TRUSTED on the code notary platform.

transitive (default: false)

Analyses the entire dependency graph of your project. By default, only direct dependencies are analysed.

requiredSigner (default: none)

Enforces that all checked dependencies must be signed by the provided signer.

Requirements

The library requires a Java 8 JVM.

CodeNotary Inc

Versions

Version
0.0.1 May 21, 2019