From 4b40d7d21ffbf88d3ed17afe959ee61b7f357457 Mon Sep 17 00:00:00 2001
From: Andrew Wang <wang@apache.org>
Date: Tue, 24 May 2016 18:29:45 -0700
Subject: [PATCH] HADOOP-13198. Add support for OWASP's dependency-check.
 Contributed by Mike Yoder.

(cherry picked from commit 09b866fd45664ff977702b58b6338ce209729a97)
(cherry picked from commit 2ea17f4578fcada8c1bcc5e97f085ca878ec5ec4)
---
 pom.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pom.xml b/pom.xml
index 51d2f065dd1..36c641dc2d4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -105,6 +105,7 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xs
     <maven-bundle-plugin.version>2.5.0</maven-bundle-plugin.version>
     <maven-checkstyle-plugin.version>2.15</maven-checkstyle-plugin.version>
     <checkstyle.version>6.6</checkstyle.version>
+    <dependency-check-maven.version>1.3.6</dependency-check-maven.version>
 
     <shell-executable>bash</shell-executable>
   </properties>
@@ -214,6 +215,11 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xs
             <outputFile>${project.build.directory}/test/checkstyle-errors.xml</outputFile>
           </configuration>
         </plugin>
+        <plugin>
+          <groupId>org.owasp</groupId>
+          <artifactId>dependency-check-maven</artifactId>
+          <version>${dependency-check-maven.version}</version>
+        </plugin>
       </plugins>
     </pluginManagement>
 
@@ -285,6 +291,17 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xs
         <artifactId>maven-checkstyle-plugin</artifactId>
         <version>${maven-checkstyle-plugin.version}</version>
       </plugin>
+      <plugin>
+        <!-- OWASP's dependency-check plugin will scan the third party
+             dependencies of this project for known CVEs (security
+             vulnerabilities against them). It will produce a report
+             in target/dependency-check-report.html. To invoke, run
+             'mvn dependency-check:aggregate'
+        -->
+        <groupId>org.owasp</groupId>
+        <artifactId>dependency-check-maven</artifactId>
+        <version>${dependency-check-maven.version}</version>
+      </plugin>
     </plugins>
   </build>