# Pro / Con of using pom.xml vs. central.mvn files for maintaining dependencies in bndtools (MavenBndRepository vs BndPomRepository)

**URL:** <https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407>\
**Category:** GENERAL\
**Created:** [January 8, 2024, 11:15pm UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407 "2024-01-08T23:15:49Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisrueger](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/chrisrueger/32/18_2.png) [@chrisrueger](https://bnd.discourse.group/u/chrisrueger)\
**Post date:** [January 8, 2024, 11:15pm UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/1 "2024-01-08T23:15:49Z")

</div>

Hi,  
I would like to use GIthub’s dependabot for analysing our dependencies to get suggestions for updates. (Disclaimer: Newbie here. Just getting started reading into dependabot… not yet tried anything.)

Currently we are using a simple `central.mvn` text file with [MavenBndRepository](https://bnd.bndtools.org/plugins/maven.html).

I think about changing to [BndPomRepository](https://bnd.bndtools.org/plugins/pomrepo.html) and maintain the same dependencies in a `pom.xml` file

## Why?

Because, Dependabot seems to [understand pom.xml files and is able to updaate them](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#maven).

## Thoughts

Is there any problem with maintaining the same stuff in a `pom.xml` instead of the flat `.mvn` file?  
Although I like the .mvn format because it is simple and slim. But having a tool like dependabot automatically be able to read a pom.xml would make me prefer the more verbose pom.xml.

I just want to have a single source (file) for the dependencies containing GAV coordinates.

How is MavenBndRepository different from BndPomRepository?  
Or would it even be a valid thought to extend MavenBndRepository to support the pom.xml format?

## Other ideas?

There also seem to be other options to tell Github the dependencies like submitting your [SBOM via an API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api#generating-and-submitting-a-software-bill-of-materials-sbom). A bit overkill IMHO. I’d prefer the simple file we have.

Would be glad to get ideas what you think, how to approach this topic.

Thanks  
Christoph

---

<div class="post-metadata">

**Author:** ![pkriens](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/pkriens/32/3_2.png) [@pkriens](https://bnd.discourse.group/u/pkriens)\
**Post date:** [January 9, 2024, 9:05am UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/2 "2024-01-09T09:05:34Z")

</div>

I contacted dependabot a couple of years ago to see if I could provide the same framework for the mvn files. They responded but said they could not handle that.

I then added lots of support to the bnd command line with the `bnd mbr` command to check and update the mvn files.

Your approach to use the pom files would work, it is what IBM does. I’d prefer to spend a bit of effort and provide a bnd Github Action that would work very similar to dependabot. The logic is already in bnd, it would just require a bit of git code. I already made the bnd command line a github action.

If there is a wider interest in this support I can take a look how much work it would be. Contact me if you’d like to expedite this.

---

<div class="post-metadata">

**Author:** ![chrisrueger](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/chrisrueger/32/18_2.png) [@chrisrueger](https://bnd.discourse.group/u/chrisrueger)\
**Post date:** [January 9, 2024, 6:28pm UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/3 "2024-01-09T18:28:12Z")

</div>

Thanks a lot. Ah yes the `bnd mbr` command. You mentioned it recently and I played around with it.  
Ok, I guess I play around with pom.xml approach first and see how it feels and then try to familarize with GH Actions.

---

<div class="post-metadata">

**Author:** ![chrisrueger](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/chrisrueger/32/18_2.png) [@chrisrueger](https://bnd.discourse.group/u/chrisrueger)\
**Post date:** [January 10, 2024, 11:18am UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/4 "2024-01-10T11:18:35Z")

</div>

For those interested here is a quick outline using the `pom.xml` approach with a `BndPomRepository` to get Github dependabot working.

1. Please the following file in `.github/dependabot.yml`

```auto
# To get started with Dependabot version updates, you'll need to specify which
# package ecosystems to update and where the package manifests are located.
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

version: 2
updates:
  - package-ecosystem: "maven" # See documentation for possible values
    directory: "/cnf/pom.xml" # Location of package manifests
    schedule:
      interval: "weekly"

```

1. place a `pom.xml` into your bnd workspace at `cnf/pom.xml`

2. Optional: Configure your repository in `cnf/build.bnd` to use `pom.xml` instead of `central.mvn`

```auto
-plugin.5.Central: \
	aQute.bnd.repository.maven.pom.provider.BndPomRepository; \
		snapshotUrl=http://repository.apache.org/snapshots/; \
		releaseUrl=https://repo.maven.apache.org/maven2/; \
		pom=${.}/pom.xml; \
		readOnly=true; \
		name="Maven Central"

```

> **instead of previously:**
>
> ```auto
> -plugin.5.Central: \
> aQute.bnd.repository.maven.provider.MavenBndRepository; \
> snapshotUrl=http://repository.apache.org/snapshots/; \
> releaseUrl=https://repo.maven.apache.org/maven2/; \
> index=${.}/central.mvn; \
> readOnly=true; \
> name="Maven Central"
> 
> ```

To create the `pom.xml` from my `central.mvn` file I used the following

> **quickly hacked Java programm:**
>
> ```auto
> 
> import java.io.BufferedReader;
> import java.io.BufferedWriter;
> import java.io.FileReader;
> import java.io.FileWriter;
> import java.io.IOException;
> 
> public class MavenDependenciesToPomConverter {
> 
> public static void main(String[] args) {
> String inputFile = "/myproject/cnf/central.maven"; // Replace with your input file path
> String outputFile = "/myproject/cnf/pom.xml"; // Replace with your desired output file path
> 
> try (BufferedReader reader = new BufferedReader(new FileReader(inputFile));
> BufferedWriter writer = new BufferedWriter(new FileWriter(outputFile))) {
> 
> writePomHeader(writer);
> 
> String line;
> while ((line = reader.readLine()) != null) {
> if (!line.trim().startsWith("#") && !line.trim().isEmpty()) {
> String[] parts = line.split(":");
> if (parts.length == 3) {
> writeDependency(writer, parts[0], parts[1], parts[2]);
> }
> else if (parts.length == 4) {
> // e.g. com.zaxxer:SparseBitSet:jar:1.2
> writeDependency(writer, parts[0], parts[1], parts[3]);
> }
> else if (parts.length == 5) {
> // e.g. org.jacoco:org.jacoco.agent:jar:runtime:0.8.10
> writeDependency(writer, parts[0], parts[1], parts[4]);
> }
> }
> }
> 
> writePomFooter(writer);
> 
> } catch (IOException e) {
> e.printStackTrace();
> }
> }
> 
> private static void writePomHeader(BufferedWriter writer) throws IOException {
> writer.write("<project xmlns=\"http://maven.apache.org/POM/4.0.0\"\n");
> writer.write(" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n");
> writer.write(" xsi:schemaLocation=\"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd\">\n");
> writer.write(" <modelVersion>4.0.0</modelVersion>\n");
> writer.write(" <groupId>your.groupid</groupId>\n");
> writer.write(" <artifactId>your-artifactid</artifactId>\n");
> writer.write(" <version>1.0-SNAPSHOT</version>\n");
> writer.write(" <dependencies>\n");
> }
> 
> private static void writeDependency(BufferedWriter writer, String groupId, String artifactId, String version) throws IOException {
> writer.write(" <dependency>\n");
> writer.write(" <groupId>" + groupId + "</groupId>\n");
> writer.write(" <artifactId>" + artifactId + "</artifactId>\n");
> writer.write(" <version>" + version + "</version>\n");
> writer.write(" </dependency>\n");
> }
> 
> private static void writePomFooter(BufferedWriter writer) throws IOException {
> writer.write(" </dependencies>\n");
> writer.write("</project>\n");
> }
> }
> 
> ```

1. push that to github and merge to main branch

2. once you enable e.g. [Security Updates for Dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates) it starts doing its work and you can filter the alerts e.g. with `is:open ecosystem:Maven`

---

<div class="post-metadata">

**Author:** ![kriegfrj](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/kriegfrj/32/24_2.png) [@kriegfrj](https://bnd.discourse.group/u/kriegfrj)\
**Post date:** [January 11, 2024, 8:58am UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/5 "2024-01-11T08:58:11Z")

</div>

> [@pkriens](#):
>
> I’d prefer to spend a bit of effort and provide a bnd Github Action that would work very similar to dependabot. The logic is already in bnd, it would just require a bit of git code. I already made the bnd command line a github action.

This would be cool…

I think the approach @chrisrueger is taking will work, but i really like the concise mvn format.

---

<div class="post-metadata">

**Author:** ![chrisrueger](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/chrisrueger/32/18_2.png) [@chrisrueger](https://bnd.discourse.group/u/chrisrueger)\
**Post date:** [January 11, 2024, 9:55am UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/6 "2024-01-11T09:55:51Z")

</div>

@pkriens is it possible e.g. with the `-generate` or another instruction to execute a small java class (like my hack above) which takes the `.mvn` file and creates a `pom.xml` out of it and places it somewhere.  
the resulting pom.xml we would just commit to git as well.

**Why the heck?**  
This little workaround is what I am basically doing by hand right now. We are just feeding dependabot something it understands. Pretty useful just to do some dependency cleanup.  
We then carefully take the bot suggestions and manually edit the .mvn file (since we needed to test the new deps anyway before they go to main branch).

Maybe not something people usually do but at the moment it fits our workflow.  
So basically I would like to know if I could leverage bndtools to create the pom.xml by running the javacode I currently run manually in eclipse.

---

<div class="post-metadata">

**Author:** ![pkriens](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/pkriens/32/3_2.png) [@pkriens](https://bnd.discourse.group/u/pkriens)\
**Post date:** [January 11, 2024, 12:31pm UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/7 "2024-01-11T12:31:21Z")

</div>

The `-generate` could work but it feels very roundabout.

I think the easiest solution is to switch to BndPomRepository. It should be mostly ok and it is not that hard to add the missing features. And the PR’s from Dependabot work immediately. I think your outline is a tad too complex for my comfort and seems quite fragile.

We could add your pom generation code to the MavenBndRepository so that it will automatically sync to a pom.xml file. However, the idea that the PR’s then need to be mapped back to the GAVs seems much more work than going for the BndPomRepository. Keep it simple.

---

<div class="post-metadata">

**Author:** ![chrisrueger](https://yyz2.discourse-cdn.com/free1/user_avatar/bnd.discourse.group/chrisrueger/32/18_2.png) [@chrisrueger](https://bnd.discourse.group/u/chrisrueger)\
**Post date:** [January 11, 2024, 4:15pm UTC](https://bnd.discourse.group/t/pro-con-of-using-pom-xml-vs-central-mvn-files-for-maintaining-dependencies-in-bndtools-mavenbndrepository-vs-bndpomrepository/407/8 "2024-01-11T16:15:44Z")

</div>

Hehe thanks for your input… yeah I was still in “workaround mode” 🙂

Yes I will try go the BndPomRepository route and help with PRs if possible.  
Edit: Created [PR](https://github.com/bndtools/bnd/pull/5964)