For example, to verify the signature of `plugin-publish-plugin-2.0.0.jar` and its signature file `plugin-publish-plugin-2.0.0.jar.asc`, use this command:

```bash
gpg --verify plugin-publish-plugin-2.0.0.jar.asc plugin-publish-plugin-2.0.0.jar
```

  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>com.github.siom79.japicmp</groupId>
        <artifactId>japicmp-maven-plugin</artifactId>
        <configuration>
          <parameter>
            <excludes>
              <exclude>org.apache.maven.plugin.lifecycle</exclude>
              <exclude>org.apache.maven.plugin.descriptor.PluginDescriptor#getLifecycleMapping(java.lang.String)</exclude>

/**
 * Fess-specific web resource root implementation for Tomcat.
 * This class extends StandardRoot to provide custom web resource handling
 * for Fess plugins, including support for plugin JAR files in the WEB-INF/plugin directory.
 */
public class FessWebResourceRoot extends StandardRoot {
    /** Logger instance for this class */
    private static final Logger logger = Logger.getLogger(FessWebResourceRoot.class.getName());

    /**
     * Cached array of available data store names discovered from plugin JAR files.
     * This cache is refreshed periodically based on the lastLoadedTime.
     */
    protected volatile String[] dataStoreNames = StringUtil.EMPTY_STRINGS;

    /**
     * Timestamp of the last time data store names were loaded from plugin files.
     * Used to implement a time-based cache refresh mechanism.

                                    </execution>
                                </executions>
                            </plugin>
                            <plugin>
                                <groupId>org.apache.maven.plugins</groupId>
                                <artifactId>maven-failsafe-plugin</artifactId>
                                <version>3.0.0-M7</version>
                                <executions>

For external plugins, it's difficult for an object to be used outside the application of a plugin, so following best practices is relatively straightforward.  For core plugins in gradle/gradle, it's easy for an object to be created without applying its associated plugin. For instance, Spring has a plugin that uses the Checkstyle task directly without applying the Checkstyle plugin.

import org.apache.maven.api.plugin.descriptor.MojoDescriptor;
import org.apache.maven.api.xml.XmlNode;

/**
 * A {@code MojoExecution} represents a single execution of a Maven Plugin during a given build.
 * An instance of this object is bound to the {@link org.apache.maven.api.di.MojoExecutionScoped}
 * and available as {@code mojoExecution} within {@link org.apache.maven.api.plugin.annotations.Parameter}
 * expressions.
 *

     * Creates a new class realm for the specified plugin.
     *
     * @param plugin The plugin for which to create a realm, must not be {@code null}.
     * @param parent The parent realm for the new realm, may be {@code null}.
     * @param parentImports The packages/types to import from the parent realm, may be {@code null}.
     * @param foreignImports The packages/types to import from foreign realms, may be {@code null}.

  <groupId>maven</groupId>
  <artifactId>p0</artifactId>
  <packaging>pom</packaging>
  <version>1.0</version>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <executions>
          <execution>
            <id>test</id>

            <!--  The key to this test... -->
            <inherited>false</inherited>

        when(project.getArtifactId()).thenReturn("maven-project-info-reports-plugin");
        when(project.getPackaging()).thenReturn("maven-plugin");
        when(project.getName()).thenReturn("Apache Maven Project Info Reports Plugin");
        when(project.getVersion()).thenReturn("3.0.0-SNAPSHOT");
        when(event.getProject()).thenReturn(project);