[
https://issues.apache.org/jira/browse/XERCESJ-1794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18073979#comment-18073979
]
Svante Schubert commented on XERCESJ-1794:
------------------------------------------
*Description*
Following [previous
discussions|https://lists.apache.org/[email protected]:2024-9] and
a [prototype developed in
2024|https://github.com/svanteschubert/xerces-j/blob/maven-prototype/pom.xml],
I propose migrating the core components of the Xerces-J build system to Apache
Maven to improve project transparency and maintainability.
(Nevertheless, to me it would be feasible to keep "special build features" in
Ant, which can not be mapped easily to Maven from the Ant script, as long as it
is well documented.)
h3. Rationale for Maven Migration.
The primary goal is to ensure a fully transparent build process. Maven
facilitates this by:
* Ensuring all dependent sources are publicly available and verifiable, rather
than relying on opaque JAR binaries.
* Standardising the build lifecycle makes it easier for new contributors to
engage with the project.
For complex "special build features" that are difficult to map directly to
Maven, we can retain specific *Ant* scripts as a hybrid solution, provided they
are clearly documented within the new structure.
h3. Technical Considerations & Known Hurdles
* Target JDK: The [previous
prototype|https://lists.apache.org/[email protected]:2024-9]
utilised JDK 11 as the baseline, being the first LTS release following the JDK
module refactoring. Allow us to add Java module information for Xerces-J, which
is required by modern Java applications using Xerces-J.
* Dependency Issues (PsychoPathXPathProcessor): Previous attempts encountered
security exceptions related to the XPath 2.0 engine. Furthermore, the
availability of this component's source at Eclipse appears inconsistent or
abandoned. I also had a [prototype with JDK8 and
PsychoPathXPathProcessor|https://github.com/svanteschubert/xerces-j/blob/maven-prototype_JDK8-PsychoPath1.2.1/pom.xml].
* Policy Compliance: Per Apache guidelines, we must ensure that all
dependencies are deployed with accessible sources. I have updated the prototype
to the specific version where sources are still findable.
> Make Build Reproducible
> -----------------------
>
> Key: XERCESJ-1794
> URL: https://issues.apache.org/jira/browse/XERCESJ-1794
> Project: Xerces2-J
> Issue Type: Improvement
> Components: Build
> Affects Versions: 2.12.3
> Reporter: Elliotte Rusty Harold
> Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
