[
https://issues.apache.org/jira/browse/XERCESJ-1795?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Elliotte Rusty Harold updated XERCESJ-1795:
-------------------------------------------
Priority: Minor (was: Major)
> Migrate Xerces-J Build System to Apache Maven
> ---------------------------------------------
>
> Key: XERCESJ-1795
> URL: https://issues.apache.org/jira/browse/XERCESJ-1795
> Project: Xerces2-J
> Issue Type: Improvement
> Reporter: Svante Schubert
> Priority: Minor
>
> *strong text*h3. Description
> Following project discussions regarding build reproducibility and
> transparency, I propose a formal migration of the *Xerces-J* build system
> from *Ant* to {*}Apache Maven{*}. While the current Ant-based system is
> functional, it relies on manual environment management and opaque binary
> dependencies that complicate modern automated security auditing and
> contributor onboarding.
> h3. Rationale for Migration
> Transitioning to Maven will align Xerces-J with standard Apache ecosystem
> practices and provide several key benefits:
> * *Transparency & Security:* Ensures all dependent sources are publicly
> available and verifiable, mitigating risks associated with supply chain
> attacks from opaque JAR binaries.
> * *Standardised Lifecycle:* A uniform build structure (e.g.,
> {{{}src/main/java{}}}) makes it easier for new contributors to engage with
> the project without learning custom Ant scripts.
> * *Modern Java Support:* Facilitates the addition of *Java Module
> Information* (JPMS), which is increasingly required by modern applications
> using Xerces-J.
> * *Dependency Management:* Enables automatic vulnerability scanning and
> resolves long-standing conflicts (e.g., IntelliJ flagging API overlaps
> between {{XercesImpl}} and the JDK).
> h3. Technical Considerations & Known Hurdles
> A prototype has already identified specific challenges that this issue must
> address:
> * *Target JDK:* The proposed baseline is {*}JDK 11{*}, the first LTS release
> supporting the JDK module refactoring. Allowing us to enable the Java
> Platform Module System.
> * *Hybrid Solution:* For "special build features" that do not map cleanly to
> Maven’s declarative model, specific Ant scripts may be retained as a
> documented hybrid solution within the new structure.
> * *Project Structure:* Maven requires a more explicit division of code into
> defined subfolders. Two years ago, the Xerces sources were on a different
> branch than their tests, making regression testing difficult.
> * *Dependency Issues (PsychoPathXPath Processor):* Two years ago, the XPath
> 2.0 engine had historically caused security exceptions and suffered from
> inconsistent source availability at Eclipse. A specific version with
> "findable" sources must be used to remain compliant with Apache guidelines.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
