[jira] [Created] (XERCESJ-1795) Migrate Xerces-J Build System to Apache Maven

["Svante Schubert (Jira)" <xe...@xml.apache.org>]

Svante Schubert created XERCESJ-1795:
----------------------------------------

             Summary: Migrate Xerces-J Build System to Apache Maven
                 Key: XERCESJ-1795
                 URL: https://issues.apache.org/jira/browse/XERCESJ-1795
             Project: Xerces2-J
          Issue Type: Improvement
            Reporter: Svante Schubert


*strong text*h3. Description

Following project discussions regarding build reproducibility and transparency, I propose a formal migration of the *Xerces-J* build system from *Ant* to {*}Apache Maven{*}. While the current Ant-based system is functional, it relies on manual environment management and opaque binary dependencies that complicate modern automated security auditing and contributor onboarding.
h3. Rationale for Migration

Transitioning to Maven will align Xerces-J with standard Apache ecosystem practices and provide several key benefits:
 * *Transparency & Security:* Ensures all dependent sources are publicly available and verifiable, mitigating risks associated with supply chain attacks from opaque JAR binaries.

 * *Standardised Lifecycle:* A uniform build structure (e.g., {{{}src/main/java{}}}) makes it easier for new contributors to engage with the project without learning custom Ant scripts.

 * *Modern Java Support:* Facilitates the addition of *Java Module Information* (JPMS), which is increasingly required by modern applications using Xerces-J.

 * *Dependency Management:* Enables automatic vulnerability scanning and resolves long-standing conflicts (e.g., IntelliJ flagging API overlaps between {{XercesImpl}} and the JDK).

h3. Technical Considerations & Known Hurdles

A prototype has already identified specific challenges that this issue must address:
 * *Target JDK:* The proposed baseline is {*}JDK 11{*}, the first LTS release supporting the JDK module refactoring. Allowing us to enable the Java Platform Module System.

 * *Hybrid Solution:* For "special build features" that do not map cleanly to Maven’s declarative model, specific Ant scripts may be retained as a documented hybrid solution within the new structure.

 * *Project Structure:* Maven requires a more explicit division of code into defined subfolders. Two years ago, the Xerces sources were on a different branch than their tests, making regression testing difficult.

 * *Dependency Issues (PsychoPathXPath Processor):* Two years ago, the XPath 2.0 engine had historically caused security exceptions and suffered from inconsistent source availability at Eclipse. A specific version with "findable" sources must be used to remain compliant with Apache guidelines.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org