[jira] [Created] (XERCESJ-1795) Migrate Xerces-J Build System to Apache Maven

Svante Schubert created XERCESJ-1795:
----------------------------------------

             Summary: Migrate Xerces-J Build System to Apache Maven
                 Key: XERCESJ-1795
                 URL: https://issues.apache.org/jira/browse/XERCESJ-1795
             Project: Xerces2-J
          Issue Type: Improvement
            Reporter: Svante Schubert


*strong text*h3. Description

Following project discussions regarding build reproducibility and transpare=
ncy, I propose a formal migration of the *Xerces-J* build system from *Ant*=
 to {*}Apache Maven{*}. While the current Ant-based system is functional, i=
t relies on manual environment management and opaque binary dependencies th=
at complicate modern automated security auditing and contributor onboarding=
.
h3. Rationale for Migration

Transitioning to Maven will align Xerces-J with standard Apache ecosystem p=
ractices and provide several key benefits:
 * *Transparency & Security:* Ensures all dependent sources are publicly av=
ailable and verifiable, mitigating risks associated with supply chain attac=
ks from opaque JAR binaries.

 * *Standardised Lifecycle:* A uniform build structure (e.g., {{{}src/main/=
java{}}}) makes it easier for new contributors to engage with the project w=
ithout learning custom Ant scripts.

 * *Modern Java Support:* Facilitates the addition of *Java Module Informat=
ion* (JPMS), which is increasingly required by modern applications using Xe=
rces-J.

 * *Dependency Management:* Enables automatic vulnerability scanning and re=
solves long-standing conflicts (e.g., IntelliJ flagging API overlaps betwee=
n {{XercesImpl}} and the JDK).

h3. Technical Considerations & Known Hurdles

A prototype has already identified specific challenges that this issue must=
 address:
 * *Target JDK:* The proposed baseline is {*}JDK 11{*}, the first LTS relea=
se supporting the JDK module refactoring. Allowing us to enable the Java Pl=
atform Module System.

 * *Hybrid Solution:* For "special build features" that do not map cleanly =
to Maven=E2=80=99s declarative model, specific Ant scripts may be retained =
as a documented hybrid solution within the new structure.

 * *Project Structure:* Maven requires a more explicit division of code int=
o defined subfolders. Two years ago, the Xerces sources were on a different=
 branch than their tests, making regression testing difficult.

 * *Dependency Issues (PsychoPathXPath Processor):* Two years ago, the XPat=
h 2.0 engine had historically caused security exceptions and suffered from =
inconsistent source availability at Eclipse. A specific version with "finda=
ble" sources must be used to remain compliant with Apache guidelines.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)