Apache Xerces2 J

Migrate Xerces-J Build System to Apache Maven

Publish xercesImpl 2.12.2 xml schema 1.1 to Maven Central

Convert tests to JUnit

Most of the tests use a very old-fashioned (1990s) approach to testing that relies on running code with main() methods. JUnit tests we do have don't seem to run as part of the build. Convert these to automated JUnit tests. Before undertaking note Read more

FYI, I have been told there are ongoing discussions about hardening Apache projects against supply chain attacks. I haven't been participating in those discussion myself. I'm not sure what they are and aren't considering. Might be worth participating Read more

I would also add that the claimed benefits for a Maven conversion generally seem to require additional work beyond the build itself. Again, if this is really more important to you than to the existing  developers, open-source practice would be for Read more

The problem of differences with the jdk's version is something you may have to take up with the jdk's maintainers. Sun historically built from their own private sources rather than from the Apache release, and I believe Oracle has continued this Read more

Any "modern automated security auditing" that can't handle Xerces is bad and should feel bad. We don't need to and shouldn't change our build system to support busted and badly designed security tools that aren't very useful and wrong more often than Read more

elharo Sure, I created https://issues.apache.org/jira/browse/XERCESJ-1795 But as stated before, please provide some further information on the Definition of done for a "reproducible build" - if there is a page listing your requirements, just Read more

*strong text*h3. Description Following project discussions regarding build reproducibility and transparency, I propose a formal migration of the Xerces-J build system from Ant to Apache Maven. While the current Ant-based system is functional, it Read more