Why does Bamboo run Java Specs with its own POM?

[Alan Raison]

I've created some Java specs and tried uploading them but it seems that Bamboo tries to merge the specs project POM with one of its own; "bamboo-specs-generator". This caused me issues when declaring versions as properties, as properties weren't being merged into the new pom, but generally I wonder why bamboo is generating its own pom when my project has a perfectly good one already!

[Gabriel Ribeiro · Accepted solution]

Hi Alan,

By default Bamboo Specs are executed with a default pom.xml film, i.e. it will not use pom.xml from your bamboo-specs project. (from: Bamboo Specs troubleshooting)

You can find the default pom file at BAMBOO_INSTALL/atlassian-bamboo/WEB-INF/classes/bamboo-specs-pom.xml

thanks

[Alan Raison]

Right. What is the benefit of this method? It seems like an arbitrary limitation (it won't improve security, for example) and an extra source of issues.

[Deleted user]

@Gabriel Ribeiro Just curious, if Bamboo doesn't use the pom.xml file from the bamboo-specs folder then why is it even required in the first place?

[Ivhani]

I'm also curious. Why does bamboo use a default pom even in a case where there is a pom? 

It would make sense to use a default pom when there's none available, otherwise use provided pom.

@Gabriel Ribeiro what is the reasoning around using a default pom always?

[Gabriel Ribeiro]

Hi @Ivhani and @[deleted] 

Since the specs build will run inside the same environment as Bamboo, The POM gets sanitized by default to avoid less experienced users (or bad intentioned ones) to import dependencies that can potentially damage Bamboo.

You can disable this behavior (at your own risk) by adding the following property to <installation directory>/bin/setenv.sh and per Configuring your system properties documentations.

-Dbamboo.repository.stored.specs.pom.sanitization.enabled=false