Stop using Xerces-C

[ryandesign]

Enigma requires Xerces-C:

checking for current Xerces release 3.0... not found
checking for old Xerces release >=2.4... configure: error: Xerces >= 2.4 not found.

​The developer of Xerces-C gives notice that it should not be used anymore.

Can Enigma switch to a different XML library that is still maintained, such as libxml2 or expat?

[sidney]

I agree. From my standpoint of trying to keep enigma building on MacOS, Xerces-C has always been a problem that keeps getting worse.

I propose libxml2 rather than expat. In searching for discussions in open source projects choosing between the two, the only ones I found leaning towards expat were quite old. The only more recent discussion I found (2022) lays out reasons for libxml2 in detail here: https://lists.apache.org/thread/r8gvbsxr22go29z0z8tzbpj56f5qxfb1

In particular, this quote: "expat has been difficult to upgrade to newer versions due to compiler issues. Since expat only implements a small subset of libxml2's features, could we replace it with libxml2?"

In addition, this link is an automated comparison of the two libraries https://cpp.libhunt.com/compare-expat-vs-libxml2
It shows that libxml2 has much higher popularity and usage, that expat was last updated 7 years ago, while libxml2 is still under active development.

[ryandesign]

expat was last updated 7 years ago

I'm not familiar with Enigma's needs in an XML library nor how the features of the various libraries compare, so I can't suggest which library would be best, however I would like to refute this statement. Like libxml2, expat remains under active development; there have been five releases this year. See http://www.libexpat.org.

The comparison page you linked to appears to be getting its data from expat's old home on SourceForge. It moved to GitHub since then.

I'm the maintainer of both of these ports in MacPorts and they compile fine on the past fifteen years' worth of macOS versions for which we have automated build machines. Xerces-C also builds fine in MacPorts on these macOS versions.

There's nothing wrong with choosing libxml2, I just want to make sure you're not discounting expat for the wrong reasons. I'm sure there are many other libraries besides just these three in fact. But choosing one that is popular is probably a good safeguard against it becoming unmaintained.

One point in libxml2's favor might be that at the top of expat's readme it says:

Caution

Expat is understaffed and without funding. There is a call for help with details at the top of the Changes file.

On the other hand, libxml2 has raised over $10,500 on opencollective so they seem to have a source of funding.

[sidney]

Thanks for the correction. Note that the link to libexpat you gave is incorrect, as the host name www.libexapt.org is a cname to sourceforge that doesn't work and there is no DNS host record for libexpat.org. I found their repo on https://github.com/libexpat/libexpat

So expat is not inactive, but that call for help is concerning, as is the fact that their libexpat.org domain has been allowed to languish. If migrating to libxml2 is not significantly harder than migrating to expat, then I would still be in favor of libxml2. Those do seem to be the two most popular and safe choices.

[ryandesign]

http://www.libexpat.org works fine for me. It redirects to https://libexpat.github.io. Nothing has languished.

I inadvertently used an https URL in my comment originally, which doesn't work; I've corrected it.