Xalan is available but without source 2.7.3

[merks]

The latest version of Xalan available at Maven Central does not provide source

https://repo1.maven.org/maven2/xalan/xalan/2.7.3/

We are current providing a much older version:

https://repo1.maven.org/maven2/xalan/xalan/2.7.2/

[jonahgraham]

That is very weird as I thought one of the checks for maven central is that sources were included. If it helps here is the link to the official download that has the sources too - https://www.apache.org/dyn/closer.cgi/xalan/xalan-j/ - since there is no OSGi headers I guess some repackaging is going to happen anyway so I hope that is useful to you.

[jonahgraham]

Here are the supposed requirements: https://central.sonatype.org/publish/requirements/#supply-javadoc-and-sources

[merks]

Indeed it's strange and very annoying. We perhaps need to do something more like we did for Ant. 🤮 Or we pretend that source doesn't matter. 😱

[akurtakov]

What still depends on xalan?

[merks]

These things:

[pcdavid]

FWIW, Sirius master (future version 7.2.2, not yet released), no longer depends on Xalan since eclipse-sirius/sirius-desktop@9a10a98 (pushed on Sep 15).

GMF Runtime (and Sirius) are still using Batik 1.16 at the moment. I see that Ed has contributed Batik 1.17 to Orbit recently, and I assume it doe not depend on Xalan anymore, but I have yet to update GMF and Sirius to that new version. I will not have time to work on this until after EclipseCon at best.

[vlsi]

The issue is that the Apache Software Foundation uses its own Nexus instance which lacks the verification rules: https://issues.apache.org/jira/browse/INFRA-24555
The latest Xalan release was executed manually, so it contains invalid pom, missing sources, and so on.

[merks]

@vlsi

Thank you for sharing that information. I see similar problems with derby where also the OSGi bundle information is invalid. 😱

[merks]

This issue is also apparently related:

https://issues.apache.org/jira/browse/INFRA-25885