[jira] [Created] (FOP-3318) Define Maven plugin versions to guarantee build reproducibility

Sean Gilligan created FOP-3318:
----------------------------------

             Summary: Define Maven plugin versions to guarantee build reproducibility
                 Key: FOP-3318
                 URL: https://issues.apache.org/jira/browse/FOP-3318
             Project: FOP
          Issue Type: Improvement
    Affects Versions: 2.11
            Reporter: Sean Gilligan


The root pom.xml does not define versions for the following plugins:

 * maven-site-plugin
 * maven-clean-plugin
 * maven-install-plugin
 * maven-deploy-plugin
 * maven-resources-plugin
 * maven-dependency-plugin
 * maven-assembly-plugin

It is a best practice in Maven-based projects to define these versions as otherwise they are determined by the version of Maven being used and can fail `offline` builds used by package managers like Nix and Guix.

The Maven Enforcer plugin is also recommended to verify that no plugins are left unspecified.




--
This message was sent by Atlassian Jira
(v8.20.10#820010)