[jira] [Commented] (XERCESJ-1794) Make Build Reproducible

    [ https://issues.apache.org/jira/browse/XERCESJ-1794?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D18=
074242#comment-18074242 ]=20

Joe Kesselman commented on XERCESJ-1794:
----------------------------------------

The problem of differences with the jdk's version is something you may have=
 to take up with the jdk's maintainers. Sun historically built from their o=
wn private sources rather than from the Apache release, and I believe Oracl=
e has continued this practice. At times, this has meant that they were runn=
ing outdated code=C2=A0 At other times, this has meant that they applied fi=
xes which they did not submit back to Apache.=C2=A0

> Make Build Reproducible
> -----------------------
>
>                 Key: XERCESJ-1794
>                 URL: https://issues.apache.org/jira/browse/XERCESJ-1794
>             Project: Xerces2-J
>          Issue Type: Improvement
>          Components: Build
>    Affects Versions: 2.12.3
>            Reporter: Elliotte Rusty Harold
>            Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks=
.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)