Svante Schubert created XERCESJ-1795:
----------------------------------------
Summary: Migrate Xerces-J Build System to Apache Maven
Key: XERCESJ-1795
URL: https://issues.apache.org/jira/browse/XERCESJ-1795
Project: Xerces2-J
Issue Type: Improvement
Reporter: Svante Schubert
*strong text*h3. Description
Following project discussions regarding build reproducibility and transparency,
I propose a formal migration of the *Xerces-J* build system from *Ant* to
{*}Apache Maven{*}. While the current Ant-based system is functional, it relies
on manual environment management and opaque binary dependencies that complicate
modern automated security auditing and contributor onboarding.
h3. Rationale for Migration
Transitioning to Maven will align Xerces-J with standard Apache ecosystem
practices and provide several key benefits:
* *Transparency & Security:* Ensures all dependent sources are publicly
available and verifiable, mitigating risks associated with supply chain attacks
from opaque JAR binaries.
* *Standardised Lifecycle:* A uniform build structure (e.g.,
{{{}src/main/java{}}}) makes it easier for new contributors to engage with the
project without learning custom Ant scripts.
* *Modern Java Support:* Facilitates the addition of *Java Module Information*
(JPMS), which is increasingly required by modern applications using Xerces-J.
* *Dependency Management:* Enables automatic vulnerability scanning and
resolves long-standing conflicts (e.g., IntelliJ flagging API overlaps between
{{XercesImpl}} and the JDK).
h3. Technical Considerations & Known Hurdles
A prototype has already identified specific challenges that this issue must
address:
* *Target JDK:* The proposed baseline is {*}JDK 11{*}, the first LTS release
supporting the JDK module refactoring. Allowing us to enable the Java Platform
Module System.
* *Hybrid Solution:* For "special build features" that do not map cleanly to
Maven’s declarative model, specific Ant scripts may be retained as a documented
hybrid solution within the new structure.
* *Project Structure:* Maven requires a more explicit division of code into
defined subfolders. Two years ago, the Xerces sources were on a different
branch than their tests, making regression testing difficult.
* *Dependency Issues (PsychoPathXPath Processor):* Two years ago, the XPath
2.0 engine had historically caused security exceptions and suffered from
inconsistent source availability at Eclipse. A specific version with "findable"
sources must be used to remain compliant with Apache guidelines.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
