pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>se.deversity</groupId>
    <artifactId>blindbean-parent</artifactId>
    <version>0.1.0</version>
    <packaging>pom</packaging>

    <name>BlindBean (parent)</name>
    <description>Reactor parent for the BlindBean modules. Homomorphic encryption behind annotations:
        mark a field @Homomorphic and operate on the encrypted value through a generated wrapper.
        Split into modules so a consumer pulls only what it uses — the annotation processor needs
        only the annotations, and the SEAL native bridge and the Vector API are isolated in their
        own modules.</description>
    <url>https://github.com/PIsberg/blindbean</url>

    <!--
      Module order is resolved by Maven from the dependency graph, but listed here bottom-up so a
      reader sees the layering:
        annotations ─ core ─ fhe ─┐
                                  runtime (math + context + async; Vector API)
        processor (annotations only)   junit (runtime)   tests (everything, classpath)
      blindbean is a thin aggregator that keeps the se.deversity:blindbean coordinate working.
    -->
    <modules>
        <module>blindbean-bom</module>
        <module>blindbean-annotations</module>
        <module>blindbean-core</module>
        <module>blindbean-fhe</module>
        <module>blindbean-runtime</module>
        <module>blindbean-processor</module>
        <module>blindbean-junit</module>
        <module>blindbean</module>
        <module>blindbean-tests</module>
    </modules>

    <licenses>
        <license>
            <name>PolyForm Noncommercial License 1.0.0</name>
            <url>https://polyformproject.org/licenses/noncommercial/1.0.0/</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <developers>
        <developer>
            <id>PIsberg</id>
            <name>Peter Isberg</name>
            <url>https://github.com/PIsberg</url>
            <organization>Deversity</organization>
            <organizationUrl>https://deversity.se</organizationUrl>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:https://github.com/PIsberg/blindbean.git</connection>
        <developerConnection>scm:git:ssh://git@github.com/PIsberg/blindbean.git</developerConnection>
        <url>https://github.com/PIsberg/blindbean</url>
        <tag>HEAD</tag>
    </scm>

    <properties>
        <!--
          The bytecode level, overridable so CI can prove the sources still build on every JDK we
          claim to support: `./mvnw verify -Dmaven.compiler.release=25`. 26 stays the default.

          The floor is 22, not 21. `java.lang.foreign` (Arena, MemorySegment, ValueLayout — used
          throughout blindbean-fhe) was a preview API in 21, and Arena.allocateFrom did not exist
          there at all, so anything below 22 fails to compile.
        -->
        <maven.compiler.release>26</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <!--
          Makes the build reproducible: jar entry timestamps come from this value instead of the
          clock, so two builds of the same source produce byte-identical artifacts and a consumer
          can verify a published jar was really built from the tagged commit. The CI job
          `reproducible-build` fails if that stops being true.

          A fixed instant, not ${maven.build.timestamp} — that would defeat the whole point.
        -->
        <project.build.outputTimestamp>2026-08-04T00:00:00Z</project.build.outputTimestamp>
        <junit.version>6.1.2</junit.version>
        <vibetags.version>1.0.0-RC10</vibetags.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Our own module versions live in one place, imported by everything. -->
            <dependency>
                <groupId>se.deversity</groupId>
                <artifactId>blindbean-bom</artifactId>
                <version>${project.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>se.deversity.vibetags</groupId>
                <artifactId>vibetags-bom</artifactId>
                <version>${vibetags.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.junit</groupId>
                <artifactId>junit-bom</artifactId>
                <version>${junit.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- JSpecify nullness annotations — version managed here, consumed as `provided` below -->
            <dependency>
                <groupId>org.jspecify</groupId>
                <artifactId>jspecify</artifactId>
                <version>1.0.1</version>
            </dependency>
            <dependency>
                <groupId>se.deversity.codekarta</groupId>
                <artifactId>code-karta-core</artifactId>
                <version>0.2.0</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!--
          The @AI* guardrail annotations are SOURCE-retention: needed to compile, gone at runtime,
          read by nobody. So `provided` here (compile-only) matches `requires static` in every
          module-info. The guardrail GENERATOR (vibetags-processor) now runs across the reactor
          (RC5): each annotated module owns a scoped CLAUDE.md, the root keeps the sidecar-merged
          block, and .vibetags-roles groups the granular .claude/rules/*.md by topic. Wired on the
          compiler plugin's annotationProcessorPaths below.
        -->
        <dependency>
            <groupId>se.deversity.vibetags</groupId>
            <artifactId>vibetags-annotations</artifactId>
            <scope>provided</scope>
        </dependency>
        <!--
          JSpecify nullness annotations. `provided` (compile-only) + `requires static org.jspecify`
          in every module-info — the same treatment as the vibetags annotations above. NullAway
          reads them at compile time; consumers need not carry them at runtime.
        -->
        <dependency>
            <groupId>org.jspecify</groupId>
            <artifactId>jspecify</artifactId>
            <scope>provided</scope>
        </dependency>
    </dependencies>

    <build>
        <pluginManagement>
            <plugins>
                <!--
                  maven-dependency-plugin, with its bytecode reader forced up to date.

                  `analyze-only` parses every class it finds, and the ASM shipped inside
                  maven-dependency-analyzer lags the JDK badly: every released version through
                  3.9.0 dies on this project with "Unsupported class file major version 70", and
                  70 is what JDK 26 emits (69, from the JDK 25 leg, fails too). That is the
                  toolchain being behind, not a defect in the dependencies it is meant to analyse.

                  Pinning ASM here fixes it without waiting for a plugin release. When the plugin
                  catches up, this override can go; the version below must stay at or above the
                  newest class file version the build produces.
                -->
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>3.9.0</version>
                    <dependencies>
                        <dependency>
                            <groupId>org.ow2.asm</groupId>
                            <artifactId>asm</artifactId>
                            <version>9.9</version>
                        </dependency>
                    </dependencies>
                    <configuration>
                        <!--
                          Two categories the analyser provably cannot see, so silencing them is
                          not sweeping anything under a rug:

                          1. Annotation-only artifacts. The @AI* guardrails are SOURCE retention
                             and jspecify is effectively so, meaning they leave no trace in the
                             bytecode analyze-only reads. They are used on every file and reported
                             unused in every module.
                          2. Aggregator artifacts. junit-jupiter and archunit-junit5 exist to pull
                             their real dependencies transitively; the code compiles against those
                             instead, so the aggregator itself always reads as unused.

                          Anything NOT listed here is a genuine finding. Do not extend this list to
                          quieten a real one.
                        -->
                        <ignoredUnusedDeclaredDependencies>
                            <dep>se.deversity.vibetags:vibetags-annotations</dep>
                            <dep>org.jspecify:jspecify</dep>
                            <dep>com.google.auto.service:auto-service</dep>
                            <dep>org.junit.jupiter:junit-jupiter</dep>
                            <dep>com.tngtech.archunit:archunit-junit5</dep>
                            <dep>org.openjdk.jmh:jmh-generator-annprocess</dep>
                        </ignoredUnusedDeclaredDependencies>
                        <ignoredUsedUndeclaredDependencies>
                            <dep>com.google.auto.service:auto-service-annotations</dep>
                            <dep>com.tngtech.archunit:archunit</dep>
                        </ignoredUsedUndeclaredDependencies>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.15.0</version>
                    <configuration>
                        <!--
                          `release` rather than source/target: it checks the sources against that
                          JDK's *API* too, which source/target does not. A build at 25 therefore
                          fails on a 26-only method instead of producing a jar that dies at runtime.

                          Preview is deliberately off. Nothing in the tree uses a preview
                          language or API feature, and a preview-compiled class file refuses to
                          load on any JDK but the exact one that produced it — which would make the
                          published jar single-version and the JDK matrix below impossible.
                        -->
                        <release>${maven.compiler.release}</release>
                        <fork>true</fork>
                        <compilerArgs>
                            <arg>--add-modules</arg>
                            <arg>jdk.incubator.vector</arg>
                            <!-- Error Prone + NullAway: nullness enforcement over @NullMarked code -->
                            <arg>-XDcompilePolicy=simple</arg>
                            <arg>--should-stop=ifError=FLOW</arg>
                            <arg>-Xplugin:ErrorProne -XepDisableAllChecks -Xep:NullAway:ERROR -XepOpt:NullAway:OnlyNullMarked=true</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED</arg>
                            <arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED</arg>
                            <arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED</arg>
                            <arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED</arg>
                            <!-- Reactor root: drives the merged repo-root CLAUDE.md/GEMINI.md aggregate. -->
                            <arg>-Avibetags.root=${maven.multiModuleProjectDirectory}</arg>
                        </compilerArgs>
                        <annotationProcessorPaths>
                            <path>
                                <groupId>com.google.errorprone</groupId>
                                <artifactId>error_prone_core</artifactId>
                                <version>2.50.0</version>
                            </path>
                            <path>
                                <groupId>com.uber.nullaway</groupId>
                                <artifactId>nullaway</artifactId>
                                <version>0.13.8</version>
                            </path>
                            <!--
                              VibeTags RC5 guardrail generator. Versionless: managed by the imported
                              vibetags-bom so the processor can never skew from the annotations.
                              Runs alongside Error Prone + NullAway. Emits per-module CLAUDE.md +
                              the sidecar-merged root block + role-grouped .claude/rules/*.md.
                            -->
                            <path>
                                <groupId>se.deversity.vibetags</groupId>
                                <artifactId>vibetags-processor</artifactId>
                            </path>
                        </annotationProcessorPaths>
                    </configuration>
                </plugin>

                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>3.5.6</version>
                    <configuration>
                        <argLine>
                            @{argLine}
                            --add-modules jdk.incubator.vector
                            --enable-native-access=ALL-UNNAMED
                        </argLine>
                        <systemPropertyVariables>
                            <license.mock.mode>true</license.mock.mode>
                        </systemPropertyVariables>
                        <!-- native tests skipped on the DLL-less Linux/macOS gate via -DexcludedGroups=native -->
                        <excludedGroups>${excludedGroups}</excludedGroups>
                    </configuration>
                </plugin>

                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <version>0.8.15</version>
                    <executions>
                        <execution>
                            <goals><goal>prepare-agent</goal></goals>
                        </execution>
                        <execution>
                            <id>report</id>
                            <phase>test</phase>
                            <goals><goal>report</goal></goals>
                        </execution>
                    </executions>
                </plugin>

                <!--
                  Static-analysis gates (build-failing, bound to `verify`). Versions/config live
                  here; each is switched on per library module by declaring the GA in <plugins>.
                  Rulesets are curated-lean and shared from config/ via multiModuleProjectDirectory
                  so every module resolves the same files. pom-packaged and test-only modules opt
                  out via checkstyle.skip / pmd.skip / spotbugs.skip.
                -->
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-checkstyle-plugin</artifactId>
                    <version>3.6.0</version>
                    <dependencies>
                        <dependency>
                            <groupId>com.puppycrawl.tools</groupId>
                            <artifactId>checkstyle</artifactId>
                            <version>13.9.0</version>
                        </dependency>
                    </dependencies>
                    <configuration>
                        <configLocation>${maven.multiModuleProjectDirectory}/config/checkstyle/checkstyle.xml</configLocation>
                        <suppressionsLocation>${maven.multiModuleProjectDirectory}/config/checkstyle/suppressions.xml</suppressionsLocation>
                        <includeTestSourceDirectory>false</includeTestSourceDirectory>
                        <!-- module descriptors have a distinct grammar checkstyle's Java parser trips on -->
                        <excludes>**/module-info.java</excludes>
                        <consoleOutput>true</consoleOutput>
                        <failOnViolation>true</failOnViolation>
                        <violationSeverity>error</violationSeverity>
                    </configuration>
                    <executions>
                        <execution>
                            <id>checkstyle-check</id>
                            <phase>verify</phase>
                            <goals><goal>check</goal></goals>
                        </execution>
                    </executions>
                </plugin>

                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-pmd-plugin</artifactId>
                    <version>3.28.0</version>
                    <dependencies>
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-core</artifactId>
                            <version>7.26.0</version>
                        </dependency>
                        <dependency>
                            <groupId>net.sourceforge.pmd</groupId>
                            <artifactId>pmd-java</artifactId>
                            <version>7.26.0</version>
                        </dependency>
                    </dependencies>
                    <configuration>
                        <rulesets>
                            <ruleset>${maven.multiModuleProjectDirectory}/config/pmd/ruleset.xml</ruleset>
                        </rulesets>
                        <includeTests>false</includeTests>
                        <failOnViolation>true</failOnViolation>
                        <printFailingErrors>true</printFailingErrors>
                        <excludes>
                            <exclude>**/module-info.java</exclude>
                        </excludes>
                    </configuration>
                    <executions>
                        <execution>
                            <id>pmd-check</id>
                            <phase>verify</phase>
                            <goals><goal>check</goal></goals>
                        </execution>
                    </executions>
                </plugin>

                <plugin>
                    <groupId>com.github.spotbugs</groupId>
                    <artifactId>spotbugs-maven-plugin</artifactId>
                    <version>4.10.3.0</version>
                    <dependencies>
                        <dependency>
                            <groupId>com.github.spotbugs</groupId>
                            <artifactId>spotbugs</artifactId>
                            <version>4.10.3</version>
                        </dependency>
                    </dependencies>
                    <configuration>
                        <effort>Max</effort>
                        <threshold>Medium</threshold>
                        <failOnError>true</failOnError>
                        <excludeFilterFile>${maven.multiModuleProjectDirectory}/config/spotbugs/exclude.xml</excludeFilterFile>
                    </configuration>
                    <executions>
                        <execution>
                            <id>spotbugs-check</id>
                            <phase>verify</phase>
                            <goals><goal>check</goal></goals>
                        </execution>
                    </executions>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <!--
              Build hygiene, bound to `validate` so it fails before anything expensive runs.

              requireJavaVersion's floor is 25, not the release level: this is the JDK running
              Maven, and the CI matrix runs 25 and 26. requireNoRepositories matters for a Central
              release — an inherited third-party repository would make the published pom
              unresolvable for consumers who do not have it configured.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.6.2</version>
                <executions>
                    <execution>
                        <id>enforce-build-hygiene</id>
                        <phase>validate</phase>
                        <goals><goal>enforce</goal></goals>
                    </execution>
                </executions>
                <configuration>
                    <rules>
                        <requireMavenVersion>
                            <version>[3.9.0,)</version>
                        </requireMavenVersion>
                        <requireJavaVersion>
                            <version>[25,)</version>
                        </requireJavaVersion>
                        <banDuplicatePomDependencyVersions/>
                        <requireNoRepositories/>
                    </rules>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
            </plugin>
            <!-- static-analysis gate: config + verify binding inherited from pluginManagement -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.pitest</groupId>
                <artifactId>pitest-maven</artifactId>
                <version>1.25.8</version>
                <dependencies>
                    <dependency>
                        <groupId>org.pitest</groupId>
                        <artifactId>pitest-junit5-plugin</artifactId>
                        <version>1.2.3</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <crossModule>true</crossModule>
                    <failWhenNoMutations>false</failWhenNoMutations>
                    <parseSurefireArgLine>false</parseSurefireArgLine>
                    <targetClasses>
                        <param>se.deversity.blindbean.*</param>
                    </targetClasses>
                    <targetTests>
                        <param>se.deversity.blindbean.*Test</param>
                    </targetTests>
                    <excludedClasses>
                        <param>se.deversity.blindbean.fhe.FheNativeBridge</param>
                    </excludedClasses>
                    <jvmArgs>
                        <jvmArg>--add-modules=jdk.incubator.vector</jvmArg>
                        <jvmArg>--enable-native-access=ALL-UNNAMED</jvmArg>
                        <jvmArg>-Dlicense.mock.mode=true</jvmArg>
                        <jvmArg>-Dblindbean.native.path=${maven.multiModuleProjectDirectory}/build-native/Release</jvmArg>
                    </jvmArgs>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <!--
          Release to Maven Central. Off by default so `mvn install` never signs or contacts
          Sonatype. Activated by the release workflow (`mvn -Prelease deploy`). Each publishable
          module inherits source/javadoc/gpg; the aggregator and the test-only modules opt out.
        -->
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <!--
                      Inherited by every module (source/javadoc skip pom-packaged modules cleanly;
                      GPG signs whatever a module produces). blindbean-tests opts out of deploy, so
                      it is never published even though it inherits these.
                    -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <version>3.4.0</version>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <goals><goal>jar-no-fork</goal></goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <version>3.11.2</version>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <goals><goal>jar</goal></goals>
                            </execution>
                        </executions>
                        <configuration>
                            <release>${maven.compiler.release}</release>
                            <additionalJOptions>
                                <additionalJOption>--add-modules</additionalJOption>
                                <additionalJOption>jdk.incubator.vector</additionalJOption>
                            </additionalJOptions>
                            <doclint>none</doclint>
                            <quiet>true</quiet>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>3.2.8</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals><goal>sign</goal></goals>
                                <configuration>
                                    <gpgArguments>
                                        <arg>--pinentry-mode</arg>
                                        <arg>loopback</arg>
                                    </gpgArguments>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <!-- Central publishing runs once, at the reactor root, for all modules. -->
                    <plugin>
                        <groupId>org.sonatype.central</groupId>
                        <artifactId>central-publishing-maven-plugin</artifactId>
                        <version>0.11.0</version>
                        <extensions>true</extensions>
                        <configuration>
                            <publishingServerId>central</publishingServerId>
                            <autoPublish>false</autoPublish>
                            <waitUntil>validated</waitUntil>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          OWASP dependency-check, kept behind a profile so it never runs in a normal build. The
          plugin downloads and maintains a local copy of the NVD feed, which is slow enough
          (hundreds of MB, rate-limited without an API key) that bolting it to `verify` would make
          every build hostage to an external service.

          Driven by .github/workflows/security-scan.yml, which supplies NVD_API_KEY and skips the
          scan outright, loudly, when that secret is absent.
        -->
        <profile>
            <id>security-scan</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>12.1.9</version>
                        <configuration>
                            <!-- CVSS 7.0 is the "high" boundary; at or above it, fail. Lower
                                 findings still land in the report for triage. -->
                            <failBuildOnCVSS>7</failBuildOnCVSS>
                            <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
                            <formats>
                                <format>HTML</format>
                                <format>JSON</format>
                            </formats>
                            <!-- The assembly analyser needs .NET and is pure noise on a JVM
                                 project; it logs an error per run and finds nothing. -->
                            <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>