[jira] [Comment Edited] (XERCESJ-1794) Make Build Reproducible

    [ https://issues.apache.org/jira/browse/XERCESJ-1794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074167#comment-18074167 ] 

Svante Schubert edited comment on XERCESJ-1794 at 4/17/26 6:42 AM:
-------------------------------------------------------------------

[[email protected]] Joe, I completely agree - transitioning to Maven is no small feat and represents a significant shift. However, the benefits are hard to ignore: streamlined dependency management, automatic vulnerability scanning with standard tools, and a much-needed push toward clean modularisation. (For instance, IntelliJ is already flagging conflicts between XercesImpl and JDK offering the same APIs (e.g. xml-apis) in the [MultiSchemaValidator|https://github.com/xmlark/msv/pull/23]).

Moreover, having sources and tests in a standardised directory structure - rather than split across branches like they were two years ago - would drastically improve maintainability. To get to the point: if I were to develop a Maven-based prototype, would the team be open to it? I know the community has been hesitant in the past, but is there more appetite for change now?
I do not want to start a side project that will never be accepted. I know the community has been hesitant in the past, but is there more appetite for change now?


was (Author: svanteschubert):
[[email protected]] Joe, I completely agree - transitioning to Maven is no small feat and represents a significant shift. However, the benefits are hard to ignore: streamlined dependency management, automatic vulnerability scanning with standard tools, and a much-needed push toward clean modularisation. (For instance, IntelliJ is already flagging conflicts between XercesImpl and xml-apis in the [MultiSchemaValidator|https://github.com/xmlark/msv/pull/23]).

Moreover, having sources and tests in a standardised directory structure - rather than split across branches like they were two years ago - would drastically improve maintainability. To get to the point: if I were to develop a Maven-based prototype, would the team be open to it? I know the community has been hesitant in the past, but is there more appetite for change now?
I do not want to start a side project that will never be accepted. I know the community has been hesitant in the past, but is there more appetite for change now?

> Make Build Reproducible
> -----------------------
>
>                 Key: XERCESJ-1794
>                 URL: https://issues.apache.org/jira/browse/XERCESJ-1794
>             Project: Xerces2-J
>          Issue Type: Improvement
>          Components: Build
>    Affects Versions: 2.12.3
>            Reporter: Elliotte Rusty Harold
>            Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)