[
https://issues.apache.org/jira/browse/XERCESJ-1794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074105#comment-18074105
]
Svante Schubert commented on XERCESJ-1794:
------------------------------------------
[~elharo] Please provide some further information of the DoD.
Isn't it about easily managing the environment: Given the same source code,
same build instructions, and same declared dependencies (not locally binaries),
anyone can rebuild the project and get bit-for-bit identical artifacts?
> Make Build Reproducible
> -----------------------
>
> Key: XERCESJ-1794
> URL: https://issues.apache.org/jira/browse/XERCESJ-1794
> Project: Xerces2-J
> Issue Type: Improvement
> Components: Build
> Affects Versions: 2.12.3
> Reporter: Elliotte Rusty Harold
> Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
