[
https://issues.apache.org/jira/browse/XERCESJ-1795?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074215#comment-18074215
]
Elliotte Rusty Harold edited comment on XERCESJ-1795 at 5/28/26 10:44 PM:
--------------------------------------------------------------------------
Any "modern automated security auditing" that can't handle Xerces is bad and
should feel bad. We don't need to and shouldn't change our build system to
support busted, poorly designed security tools that aren't very useful and
wrong more often than they're right.
Switching JDKs is a completely separate issue. Again, let's try not to mix up
orthogonal points.
JPMS also does not necessitate Maven. If there are improvements that need to be
made there, file a separate issue. (Not that JPMS is useful or that anyone
should be using it for anything, but it does show up so we should at least try
not to make developers' work harder.)
I'm not familiar with the PsychoPathXPath issues you cite, but again that has
nothing to do with moving to Maven. Please file an issue with details on that.
A familiar lifecycle is a benefit of Maven, and might be worth doing, though
there's likely not sufficient developer availability right now to prioritize
this. Other improvements need not wait for this to happen.
was (Author: elharo):
Any "modern automated security auditing" that can't handle Xerces is bad and
should feel bad. We don't need to and shouldn't change our build system to
support busted and badly designed security tools that aren't very useful and
wrong more often than they're right.
Switching JDKs is a completely separate issue. Again, let's try not to mix up
orthogonal points.
JPMS also does not necessitate Maven. If there are improvements that need to be
made there, file a separate issue. (Not that JPMS is useful or that anyone
should be using it for anything, but it does show up so we should at least try
not to make developers' work harder.)
I'm not familiar with the PsychoPathXPath issues you cite, but again that has
nothing to do with moving to Maven. Please file an issue with details on that.
A familiar Lifecycle is a benefit of Maven, and might be worth doing, though
there's likely not sufficient developer availability right now to prioritize
this. Other improvements need not wait for this to happen.
> Migrate Xerces-J Build System to Apache Maven
> ---------------------------------------------
>
> Key: XERCESJ-1795
> URL: https://issues.apache.org/jira/browse/XERCESJ-1795
> Project: Xerces2-J
> Issue Type: Improvement
> Reporter: Svante Schubert
> Priority: Major
>
> *strong text*h3. Description
> Following project discussions regarding build reproducibility and
> transparency, I propose a formal migration of the *Xerces-J* build system
> from *Ant* to {*}Apache Maven{*}. While the current Ant-based system is
> functional, it relies on manual environment management and opaque binary
> dependencies that complicate modern automated security auditing and
> contributor onboarding.
> h3. Rationale for Migration
> Transitioning to Maven will align Xerces-J with standard Apache ecosystem
> practices and provide several key benefits:
> * *Transparency & Security:* Ensures all dependent sources are publicly
> available and verifiable, mitigating risks associated with supply chain
> attacks from opaque JAR binaries.
> * *Standardised Lifecycle:* A uniform build structure (e.g.,
> {{{}src/main/java{}}}) makes it easier for new contributors to engage with
> the project without learning custom Ant scripts.
> * *Modern Java Support:* Facilitates the addition of *Java Module
> Information* (JPMS), which is increasingly required by modern applications
> using Xerces-J.
> * *Dependency Management:* Enables automatic vulnerability scanning and
> resolves long-standing conflicts (e.g., IntelliJ flagging API overlaps
> between {{XercesImpl}} and the JDK).
> h3. Technical Considerations & Known Hurdles
> A prototype has already identified specific challenges that this issue must
> address:
> * *Target JDK:* The proposed baseline is {*}JDK 11{*}, the first LTS release
> supporting the JDK module refactoring. Allowing us to enable the Java
> Platform Module System.
> * *Hybrid Solution:* For "special build features" that do not map cleanly to
> Maven’s declarative model, specific Ant scripts may be retained as a
> documented hybrid solution within the new structure.
> * *Project Structure:* Maven requires a more explicit division of code into
> defined subfolders. Two years ago, the Xerces sources were on a different
> branch than their tests, making regression testing difficult.
> * *Dependency Issues (PsychoPathXPath Processor):* Two years ago, the XPath
> 2.0 engine had historically caused security exceptions and suffered from
> inconsistent source availability at Eclipse. A specific version with
> "findable" sources must be used to remain compliant with Apache guidelines.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
