Very thorough!  Apache is a bit sloppy,  '(for-each delete-file (find-file...) is the minimalistic scheme we adore and I'll be happy to post a revised patch with all of that but I may wait until you've finished the source review because there is no telling what else has Apache has packed in there.  Please let me know.

Thanks,
Frank

On Fri, Mar 18, 2022 at 8:07 PM Maxime Devos <maximedevos@telenet.be> wrote:
Frank Pursel schreef op vr 18-03-2022 om 19:16 [+0000]:
> +     (origin
> +       (method url-fetch)
> +       (uri (string-append "mirror://apache/xalan/xalan-j/source/xalan-j_"
> +                           (string-replace-substring
> +                            version "." "_")
> +                           "-src.tar.gz"))
> +       (sha256
> +        (base32 "166vg9i11qzi0vbv09abfb50q8caq8wr6zrwg0cwqws9k394l62w"))
> +       (modules '((guix build utils)))
> +       (snippet '(begin
> +                   ;; Removing bundled jars
> +                   (for-each
> +                    (lambda (f)
> +                      (delete-file f))
> +                    (find-files "." "\\.(jar|tar\\.gz)$"))))))

Can be simplified to:

    (snippet '(for-each delete-file (delete-files "." "\\.(jar|tar\\.gz)$")))

Also, xalan-j_2_7_2/samples/AppletXMLtoHTML/rabbitwhorn.jpg is an (uncoloured)
picture of a rabbit from Alice in Wonderland (not asl2.0).  According to
<https://commons.wikimedia.org/wiki/File:Alice_par_John_Tenniel_37.png>,
the copyright has been expired.  As such, perhaps the 'license' field
needs to be changed to

  (license (list license:asl2.0 ; almost everything
                 ;; samples/AppletXMLtoHTML/rabbitwhorn.jpg, according to
                 ;; <https://commons.wikimedia.org/wiki/File:Alice_par_John_Tenniel_37.png>
                 license:public-domain))

Aside from that, LGTM.  I've been reading the source code, not seeing anything
‘suspicous’ (malware etc.) so far (I'm currently at
xalan-j_2_7_2/src/org/apache/xalan/templates/FuncKey.java, 25%).

Greetings,
Maxime.