[
https://issues.apache.org/jira/browse/XERCESJ-1794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074242#comment-18074242
]
Joe Kesselman commented on XERCESJ-1794:
----------------------------------------
The problem of differences with the jdk's version is something you may have to
take up with the jdk's maintainers. Sun historically built from their own
private sources rather than from the Apache release, and I believe Oracle has
continued this practice. At times, this has meant that they were running
outdated code At other times, this has meant that they applied fixes which
they did not submit back to Apache.
> Make Build Reproducible
> -----------------------
>
> Key: XERCESJ-1794
> URL: https://issues.apache.org/jira/browse/XERCESJ-1794
> Project: Xerces2-J
> Issue Type: Improvement
> Components: Build
> Affects Versions: 2.12.3
> Reporter: Elliotte Rusty Harold
> Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
