[jira] [Commented] (XERCESJ-1794) Make Build Reproducible

    [ https://issues.apache.org/jira/browse/XERCESJ-1794?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D18=
074244#comment-18074244 ]=20

Joe Kesselman commented on XERCESJ-1794:
----------------------------------------

I would also add that the claimed benefits for a Maven conversion generally=
 seem to require additional work beyond the build itself. Again, if this is=
 really more important to you than to the existing=C2=A0 developers, open-s=
ource practice would be for you to contribute the resources to make it happ=
en, or hire someone to do so.=C2=A0

=C2=A0

In the past, Xalan's definition of a successful build has been 'passes all =
REC and=C2=A0 regression tests except for those known to fail due to docume=
nted bugs or accepted divergences.'=C2=A0 That may more may not want to be =
modified in these days of library corruption, but if so I would suggest Apa=
che as a whole should establish best practices for that. (Which might have =
to involve using Apache-controlled repositories rather than the main Maven =
repos =E2=80=93 but that is off the cuff pre-coffee speculation , not a wel=
l considered proposal.)

> Make Build Reproducible
> -----------------------
>
>                 Key: XERCESJ-1794
>                 URL: https://issues.apache.org/jira/browse/XERCESJ-1794
>             Project: Xerces2-J
>          Issue Type: Improvement
>          Components: Build
>    Affects Versions: 2.12.3
>            Reporter: Elliotte Rusty Harold
>            Priority: Critical
>
> This is increasingly important to avoid and mitigate supply chain attacks=
.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)