[jira] [Comment Edited] (XERCESJ-1794) Make Build Reproducible

    [ https://issues.apache.org/jira/browse/XERCESJ-1794?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D18=
074134#comment-18074134 ]=20

Joe Kesselman edited comment on XERCESJ-1794 at 4/17/26 2:10 AM:
-----------------------------------------------------------------

Having fought my way through migrating Xalan from Ant to Maven build (we st=
ill need to make that the official release), it was *not* a trivial convers=
ion. Maven sequencing is less dependency driven than ant (or make files!) a=
nd requires more explicit division of code into subprojects, and finding th=
e right plugins to do what you need can be a pain.=C2=A0

Honestly, while I made it work (with a lot of help), my conclusion is that =
I really don't like Maven build that much,=C2=A0 though the artifact librar=
y is a good thing.=C2=A0

So I would share concerns about priorities and resources rather than assumi=
ng Maven will be an easy improvement.


was (Author: JIRAUSER285361):
Having fight my way through migrating Xalan from Ant to Maven build (we sti=
ll need to make that the official release), it was *not* a trivial conversi=
on. Maven sequencing is less dependency driven than ant (or make files!) an=
d requires more explicit division of code into subprojects, and finding the=
 right plugins to do what you need can be a pain.=C2=A0

Honestly, while I made it work (with a lot of help), my conclusion is that =
I really don't like Maven build that much,=C2=A0 though the artifact librar=
y is a good thing.=C2=A0

So I would share concerns about priorities and resources rather than assumi=
ng Maven will be an easy improvement.

> Make Build Reproducible
> -----------------------
>
>                 Key: XERCESJ-1794
>                 URL: https://issues.apache.org/jira/browse/XERCESJ-1794
>             Project: Xerces2-J
>          Issue Type: Improvement
>          Components: Build
>    Affects Versions: 2.12.3
>            Reporter: Elliotte Rusty Harold
>            Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks=
.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)