[
https://issues.apache.org/jira/browse/XERCESJ-1794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074244#comment-18074244
]
Joe Kesselman commented on XERCESJ-1794:
----------------------------------------
I would also add that the claimed benefits for a Maven conversion generally
seem to require additional work beyond the build itself. Again, if this is
really more important to you than to the existing developers, open-source
practice would be for you to contribute the resources to make it happen, or
hire someone to do so.
In the past, Xalan's definition of a successful build has been 'passes all REC
and regression tests except for those known to fail due to documented bugs or
accepted divergences.' That may more may not want to be modified in these days
of library corruption, but if so I would suggest Apache as a whole should
establish best practices for that. (Which might have to involve using
Apache-controlled repositories rather than the main Maven repos – but that is
off the cuff pre-coffee speculation , not a well considered proposal.)
> Make Build Reproducible
> -----------------------
>
> Key: XERCESJ-1794
> URL: https://issues.apache.org/jira/browse/XERCESJ-1794
> Project: Xerces2-J
> Issue Type: Improvement
> Components: Build
> Affects Versions: 2.12.3
> Reporter: Elliotte Rusty Harold
> Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
