[jira] [Comment Edited] (XERCESJ-1794) Make Build Reproducible

    [ https://issues.apache.org/jira/browse/XERCESJ-1794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18073979#comment-18073979 ] 

Svante Schubert edited comment on XERCESJ-1794 at 4/16/26 1:09 PM:
-------------------------------------------------------------------

*Description*

Following [previous discussions|https://lists.apache.org/[email protected]:2024-9] and a [prototype developed in 2024|https://github.com/svanteschubert/xerces-j/blob/maven-prototype/pom.xml], I propose migrating the core components of the Xerces-J build system to Apache Maven to improve project transparency and maintainability.

h3. Rationale for Maven Migration.

The primary goal is to ensure a fully transparent build process. Maven facilitates this by:
 * Ensuring all dependent sources are publicly available and verifiable, rather than relying on opaque JAR binaries.

 * Standardising the build lifecycle makes it easier for new contributors to engage with the project.

For complex "special build features" that are difficult to map directly to Maven, we can retain specific *Ant* scripts as a hybrid solution, provided they are clearly documented within the new structure.
h3. Technical Considerations & Known Hurdles
 * Target JDK: The [previous prototype|https://lists.apache.org/[email protected]:2024-9] utilised JDK 11 as the baseline, being the first LTS release following the JDK module refactoring. Allow us to add Java module information for Xerces-J, which is required by modern Java applications using Xerces-J.

 * Dependency Issues (PsychoPathXPathProcessor): Previous attempts encountered security exceptions related to the XPath 2.0 engine. Furthermore, the availability of this component's source at Eclipse appears inconsistent or abandoned. I also had a [prototype with JDK8 and PsychoPathXPathProcessor|https://github.com/svanteschubert/xerces-j/blob/maven-prototype_JDK8-PsychoPath1.2.1/pom.xml].

 * Policy Compliance: Per Apache guidelines, we must ensure that all dependencies are deployed with accessible sources. I have updated the prototype to the specific version where sources are still findable.

 


was (Author: svanteschubert):
*Description*

Following [previous discussions|https://lists.apache.org/[email protected]:2024-9] and a [prototype developed in 2024|https://github.com/svanteschubert/xerces-j/blob/maven-prototype/pom.xml], I propose migrating the core components of the Xerces-J build system to Apache Maven to improve project transparency and maintainability.
(Nevertheless, to me it would be feasible to keep "special build features" in Ant, which can not be mapped easily to Maven from the Ant script, as long as it is well documented.)
h3. Rationale for Maven Migration.

The primary goal is to ensure a fully transparent build process. Maven facilitates this by:
 * Ensuring all dependent sources are publicly available and verifiable, rather than relying on opaque JAR binaries.

 * Standardising the build lifecycle makes it easier for new contributors to engage with the project.

For complex "special build features" that are difficult to map directly to Maven, we can retain specific *Ant* scripts as a hybrid solution, provided they are clearly documented within the new structure.
h3. Technical Considerations & Known Hurdles
 * Target JDK: The [previous prototype|https://lists.apache.org/[email protected]:2024-9] utilised JDK 11 as the baseline, being the first LTS release following the JDK module refactoring. Allow us to add Java module information for Xerces-J, which is required by modern Java applications using Xerces-J.

 * Dependency Issues (PsychoPathXPathProcessor): Previous attempts encountered security exceptions related to the XPath 2.0 engine. Furthermore, the availability of this component's source at Eclipse appears inconsistent or abandoned. I also had a [prototype with JDK8 and PsychoPathXPathProcessor|https://github.com/svanteschubert/xerces-j/blob/maven-prototype_JDK8-PsychoPath1.2.1/pom.xml].

 * Policy Compliance: Per Apache guidelines, we must ensure that all dependencies are deployed with accessible sources. I have updated the prototype to the specific version where sources are still findable.

 

> Make Build Reproducible
> -----------------------
>
>                 Key: XERCESJ-1794
>                 URL: https://issues.apache.org/jira/browse/XERCESJ-1794
>             Project: Xerces2-J
>          Issue Type: Improvement
>          Components: Build
>    Affects Versions: 2.12.3
>            Reporter: Elliotte Rusty Harold
>            Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)