[jira] [Commented] (XERCESJ-1794) Make Build Reproducible

    [ https://issues.apache.org/jira/browse/XERCESJ-1794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074134#comment-18074134 ] 

Joe Kesselman commented on XERCESJ-1794:
----------------------------------------

Having fight my way through migrating Xalan from Ant to Maven build (we still need to make that the official release), it was *not* a trivial conversion. Maven sequencing is less dependency driven than ant (or make files!) and requires more explicit division of code into subprojects, and finding the right plugins to do what you need can be a pain. 

Honestly, while I made it work (with a lot of help), my conclusion is that I really don't like Maven build that much,  though the artifact library is a good thing. 

So I would share concerns about priorities and resources rather than assuming Maven will be an easy improvement.

> Make Build Reproducible
> -----------------------
>
>                 Key: XERCESJ-1794
>                 URL: https://issues.apache.org/jira/browse/XERCESJ-1794
>             Project: Xerces2-J
>          Issue Type: Improvement
>          Components: Build
>    Affects Versions: 2.12.3
>            Reporter: Elliotte Rusty Harold
>            Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)