You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by Matt Sicker <bo...@gmail.com> on 2021/12/13 06:18:40 UTC
[VOTE] Release Log4j 2.16.0-rc1
This is a vote to release Log4j 2.16.0, the next version of the Log4j 2 project.
Please download, test, and cast your votes on the log4j developers list.
[] +1, release the artifacts
[] -1, don't release because...
The vote will remain open for 72 hours (or more if required). All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
Changes in this release include:
Fixed Bugs
* LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi to be set to true to allow JNDI.
* LOG4J2-3211: Completely remove support for Message Lookups.
Tag:
a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git <https://github.com/apache/logging-log4j2.git>" and then "git checkout tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1 https://github.com/apache/logging-log4j2.git <https://github.com/apache/logging-log4j2.git>"
b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.16.0-rc1”
Web Site: https://logging.staged.apache.org/log4j/2.x/index.html <https://logging.staged.apache.org/log4j/2.x/index.html>.
Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1068 <https://repository.apache.org/content/repositories/orgapachelogging-1068>
Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/ <https://dist.apache.org/repos/dist/dev/logging/log4j/>
You may download all the Maven artifacts by executing:
wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
--
Matt Sicker
Re: [VOTE] Release Log4j 2.16.0-rc1
Posted by Ron Grabowski <ro...@yahoo.com.INVALID>.
I saw the vote has already been closed on log4j-2.16.0-rc1, +1 from me
for completeness. No cassandra errors with rat:check this time:
mvn clean install -t toolchains-sample-win.xml
mvn revapi:check -pl log4j-api
mvn apache-rat:check
Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
Maven home: C:\projects\apache-maven-3.8.4
Java version: 1.8.0_181, vendor: Oracle Corporation, runtime: C:\Program
Files\Java\jdk1.8.0_181\jre
Default locale: en_US, platform encoding: Cp1252
OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
On 12/13/2021 8:04 AM, Gary Gregory wrote:
> +1
>
> mvn clean package
> mvn apache-rat:check
>
> Is this command 'wrong'?
> mvn revapi:check -pl log4j-api
> I get errors.
>
> My Maven toolchain file contains mappings for Java 8, 11, 17.
>
> Same failure as before on Windows 10 and Java 8 in the restricted JNDI
> test. Could be something odd with my set up I suppose.
>
> Darwin gdg-mac-mini.local 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13
> 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64
>
> openjdk version "1.8.0_312"
> OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
> OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
>
> Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
> Maven home: /usr/local/Cellar/maven/3.8.4/libexec
> Java version: 1.8.0_312, vendor: Homebrew, runtime:
> /usr/local/Cellar/openjdk@8/1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "12.0.1", arch: "x86_64", family: "mac"
>
> Gary
>
>
> On Mon, Dec 13, 2021 at 6:22 AM Remko Popma <re...@gmail.com> wrote:
>
>> +1 build succeeds and tests all pass
>>
>> Apache Maven 3.6.2 (40f52333136460af0dc0d7232c0dc0bcf0d9e117;
>> 2019-08-28T00:06:16+09:00)
>> Maven home: C:\apps\apache-maven-3.6.2\bin\..
>> Java version: 1.8.0_202, vendor: Oracle Corporation, runtime:
>> C:\apps\jdk1.8.0_202\jre
>> Default locale: en_GB, platform encoding: MS932
>> OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
>>
>> On Mon, Dec 13, 2021 at 7:19 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
>>
>>> +1
>>>
>>> `./mvnw verify` on `log4j-2.16.0-rc1` branch passes with the following
>>> setup:
>>>
>>> $ java -version
>>> openjdk version "1.8.0_312"
>>> OpenJDK Runtime Environment (Zulu 8.58.0.13-CA-linux64) (build
>>> 1.8.0_312-b07)
>>> OpenJDK 64-Bit Server VM (Zulu 8.58.0.13-CA-linux64) (build 25.312-b07,
>>> mixed mode)
>>>
>>> $ java -version
>>> openjdk version "17.0.1" 2021-10-19 LTS
>>> OpenJDK Runtime Environment Zulu17.30+15-CA (build 17.0.1+12-LTS)
>>> OpenJDK 64-Bit Server VM Zulu17.30+15-CA (build 17.0.1+12-LTS, mixed
>> mode,
>>> sharing)
>>>
>>> $ uname -a
>>> Linux tahta 5.11.0-41-generic #45~20.04.1-Ubuntu SMP Wed Nov 10 10:20:10
>>> UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
>>>
>>> Though I would appreciate some small fixes, which can be incorporated
>> later
>>> on as well:
>>>
>>> 1. index.md.vm contains references to 2.15.1 and misses Remko's
>>> improvements in LOG4J2-3214
>>> <https://issues.apache.org/jira/browse/LOG4J2-3214>
>>> 2. security.md needs to be aligned with LOG4J2-3214
>>> <https://issues.apache.org/jira/browse/LOG4J2-3214> too
>>> 3. appenders.xml contains references to 2.15.1
>>> 4. lookups.xml contains references to 2.15.1
>>> 5. I want a link to myself in support.md too!
>>> 6. I have encountered multiple occurrences of *"release contains one
>>> change"* phrase, yet there are actually two changes. I would rather
>>> rephrase this as *"release contains a limited set of changes focusing
>> on
>>> security"*.
>>> 7. I have seen that CassandraAppenderIT is disabled due to aarch64
>>> failures. I would appreciate a ticket for incorporating a
>>> @DisabledOnArch
>>> annotation.
>>> 8. In Interpolator.java, there are usages of
>>> `JndiLookup.class.getName()` and
>>> `"org.apache.logging.log4j.core.lookup.JndiLookup"`, I'd settle on
>> one.
>>> 9. JNDI changes look good to me, great job Ralph!
>>> 10. I am baffled to see that SimplePerfTest.bubbleSort() was broken,
>> yet
>>> tests were passing! (Thanks Matt!)
>>>
>>> I can actually incorporate website fixes. What is the procedure for that?
>>> Create a `release-2.16.0` branch derived from `log4j-2.16.0-rc1` tag and
>>> commit changes there?
>>>
>>> On Mon, Dec 13, 2021 at 9:02 AM Ralph Goers <ra...@dslextreme.com>
>>> wrote:
>>>
>>>> +1
>>>>
>>>> Verified the signature and the SHA512 hashes. Verified the build worked
>>>> for me. I did correct some mistakes in the staging site home page news
>>>> section as it still referenced 2.15.1.
>>>>
>>>> Ralph
>>>>
>>>>
>>>>> On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com> wrote:
>>>>>
>>>>> This is a vote to release Log4j 2.16.0, the next version of the
>> Log4j 2
>>>> project.
>>>>> Please download, test, and cast your votes on the log4j developers
>>> list.
>>>>> [] +1, release the artifacts
>>>>> [] -1, don't release because...
>>>>>
>>>>> The vote will remain open for 72 hours (or more if required). All
>> votes
>>>> are welcome and we encourage everyone to test the release, but only
>>> Logging
>>>> PMC votes are “officially” counted. As always, at least 3 +1 votes and
>>> more
>>>> positive than negative votes are required.
>>>>> Changes in this release include:
>>>>>
>>>>> Fixed Bugs
>>>>>
>>>>> * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi to
>> be
>>>> set to true to allow JNDI.
>>>>> * LOG4J2-3211: Completely remove support for Message Lookups.
>>>>>
>>>>> Tag:
>>>>> a) for a new copy do "git clone
>>>> https://github.com/apache/logging-log4j2.git <
>>>> https://github.com/apache/logging-log4j2.git>" and then "git checkout
>>>> tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1
>>>> https://github.com/apache/logging-log4j2.git <
>>>> https://github.com/apache/logging-log4j2.git>"
>>>>> b) for an existing working copy to “git pull” and then “git checkout
>>>> tags/log4j-2.16.0-rc1”
>>>>> Web Site: https://logging.staged.apache.org/log4j/2.x/index.html <
>>>> https://logging.staged.apache.org/log4j/2.x/index.html>.
>>>>> Maven Artifacts:
>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>>> <
>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>>>>> Distribution archives:
>>>> https://dist.apache.org/repos/dist/dev/logging/log4j/ <
>>>> https://dist.apache.org/repos/dist/dev/logging/log4j/>
>>>>> You may download all the Maven artifacts by executing:
>>>>> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate
>> https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
>>>>> --
>>>>> Matt Sicker
>>>>>
>>>>
>>>>
[VOTE][RESULT] Release Log4j 2.16.0-rc1
Posted by Matt Sicker <bo...@gmail.com>.
And my +1. This makes 5 +1 votes, no -1 votes. I’ll continue with the release.
--
Matt Sicker
> On Dec 13, 2021, at 09:30, Gary Gregory <ga...@gmail.com> wrote:
>
> Depending on the RM's availability, I think we can proceed here.
>
> Gary
>
> On Mon, Dec 13, 2021 at 10:30 AM Gary Gregory <ga...@gmail.com>
> wrote:
>
>> Depending on the RM's availability
>>
>> On Mon, Dec 13, 2021 at 8:04 AM Gary Gregory <ga...@gmail.com>
>> wrote:
>>
>>> +1
>>>
>>> mvn clean package
>>> mvn apache-rat:check
>>>
>>> Is this command 'wrong'?
>>> mvn revapi:check -pl log4j-api
>>> I get errors.
>>>
>>> My Maven toolchain file contains mappings for Java 8, 11, 17.
>>>
>>> Same failure as before on Windows 10 and Java 8 in the restricted JNDI
>>> test. Could be something odd with my set up I suppose.
>>>
>>> Darwin gdg-mac-mini.local 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13
>>> 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64
>>>
>>> openjdk version "1.8.0_312"
>>> OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
>>> OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
>>>
>>> Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
>>> Maven home: /usr/local/Cellar/maven/3.8.4/libexec
>>> Java version: 1.8.0_312, vendor: Homebrew, runtime:
>>> /usr/local/Cellar/openjdk@8
>>> /1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
>>> Default locale: en_US, platform encoding: UTF-8
>>> OS name: "mac os x", version: "12.0.1", arch: "x86_64", family: "mac"
>>>
>>> Gary
>>>
>>>
>>> On Mon, Dec 13, 2021 at 6:22 AM Remko Popma <re...@gmail.com>
>>> wrote:
>>>
>>>> +1 build succeeds and tests all pass
>>>>
>>>> Apache Maven 3.6.2 (40f52333136460af0dc0d7232c0dc0bcf0d9e117;
>>>> 2019-08-28T00:06:16+09:00)
>>>> Maven home: C:\apps\apache-maven-3.6.2\bin\..
>>>> Java version: 1.8.0_202, vendor: Oracle Corporation, runtime:
>>>> C:\apps\jdk1.8.0_202\jre
>>>> Default locale: en_GB, platform encoding: MS932
>>>> OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
>>>>
>>>> On Mon, Dec 13, 2021 at 7:19 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
>>>>
>>>>> +1
>>>>>
>>>>> `./mvnw verify` on `log4j-2.16.0-rc1` branch passes with the following
>>>>> setup:
>>>>>
>>>>> $ java -version
>>>>> openjdk version "1.8.0_312"
>>>>> OpenJDK Runtime Environment (Zulu 8.58.0.13-CA-linux64) (build
>>>>> 1.8.0_312-b07)
>>>>> OpenJDK 64-Bit Server VM (Zulu 8.58.0.13-CA-linux64) (build 25.312-b07,
>>>>> mixed mode)
>>>>>
>>>>> $ java -version
>>>>> openjdk version "17.0.1" 2021-10-19 LTS
>>>>> OpenJDK Runtime Environment Zulu17.30+15-CA (build 17.0.1+12-LTS)
>>>>> OpenJDK 64-Bit Server VM Zulu17.30+15-CA (build 17.0.1+12-LTS, mixed
>>>> mode,
>>>>> sharing)
>>>>>
>>>>> $ uname -a
>>>>> Linux tahta 5.11.0-41-generic #45~20.04.1-Ubuntu SMP Wed Nov 10
>>>> 10:20:10
>>>>> UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
>>>>>
>>>>> Though I would appreciate some small fixes, which can be incorporated
>>>> later
>>>>> on as well:
>>>>>
>>>>> 1. index.md.vm contains references to 2.15.1 and misses Remko's
>>>>> improvements in LOG4J2-3214
>>>>> <https://issues.apache.org/jira/browse/LOG4J2-3214>
>>>>> 2. security.md needs to be aligned with LOG4J2-3214
>>>>> <https://issues.apache.org/jira/browse/LOG4J2-3214> too
>>>>> 3. appenders.xml contains references to 2.15.1
>>>>> 4. lookups.xml contains references to 2.15.1
>>>>> 5. I want a link to myself in support.md too!
>>>>> 6. I have encountered multiple occurrences of *"release contains one
>>>>> change"* phrase, yet there are actually two changes. I would rather
>>>>> rephrase this as *"release contains a limited set of changes
>>>> focusing on
>>>>> security"*.
>>>>> 7. I have seen that CassandraAppenderIT is disabled due to aarch64
>>>>> failures. I would appreciate a ticket for incorporating a
>>>>> @DisabledOnArch
>>>>> annotation.
>>>>> 8. In Interpolator.java, there are usages of
>>>>> `JndiLookup.class.getName()` and
>>>>> `"org.apache.logging.log4j.core.lookup.JndiLookup"`, I'd settle on
>>>> one.
>>>>> 9. JNDI changes look good to me, great job Ralph!
>>>>> 10. I am baffled to see that SimplePerfTest.bubbleSort() was
>>>> broken, yet
>>>>> tests were passing! (Thanks Matt!)
>>>>>
>>>>> I can actually incorporate website fixes. What is the procedure for
>>>> that?
>>>>> Create a `release-2.16.0` branch derived from `log4j-2.16.0-rc1` tag
>>>> and
>>>>> commit changes there?
>>>>>
>>>>> On Mon, Dec 13, 2021 at 9:02 AM Ralph Goers <
>>>> ralph.goers@dslextreme.com>
>>>>> wrote:
>>>>>
>>>>>> +1
>>>>>>
>>>>>> Verified the signature and the SHA512 hashes. Verified the build
>>>> worked
>>>>>> for me. I did correct some mistakes in the staging site home page
>>>> news
>>>>>> section as it still referenced 2.15.1.
>>>>>>
>>>>>> Ralph
>>>>>>
>>>>>>
>>>>>>> On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com>
>>>> wrote:
>>>>>>>
>>>>>>> This is a vote to release Log4j 2.16.0, the next version of the
>>>> Log4j 2
>>>>>> project.
>>>>>>>
>>>>>>> Please download, test, and cast your votes on the log4j developers
>>>>> list.
>>>>>>> [] +1, release the artifacts
>>>>>>> [] -1, don't release because...
>>>>>>>
>>>>>>> The vote will remain open for 72 hours (or more if required). All
>>>> votes
>>>>>> are welcome and we encourage everyone to test the release, but only
>>>>> Logging
>>>>>> PMC votes are “officially” counted. As always, at least 3 +1 votes
>>>> and
>>>>> more
>>>>>> positive than negative votes are required.
>>>>>>>
>>>>>>> Changes in this release include:
>>>>>>>
>>>>>>> Fixed Bugs
>>>>>>>
>>>>>>> * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi
>>>> to be
>>>>>> set to true to allow JNDI.
>>>>>>> * LOG4J2-3211: Completely remove support for Message Lookups.
>>>>>>>
>>>>>>> Tag:
>>>>>>> a) for a new copy do "git clone
>>>>>> https://github.com/apache/logging-log4j2.git <
>>>>>> https://github.com/apache/logging-log4j2.git>" and then "git
>>>> checkout
>>>>>> tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1
>>>>>> https://github.com/apache/logging-log4j2.git <
>>>>>> https://github.com/apache/logging-log4j2.git>"
>>>>>>> b) for an existing working copy to “git pull” and then “git
>>>> checkout
>>>>>> tags/log4j-2.16.0-rc1”
>>>>>>>
>>>>>>> Web Site: https://logging.staged.apache.org/log4j/2.x/index.html
>>>> <
>>>>>> https://logging.staged.apache.org/log4j/2.x/index.html>.
>>>>>>>
>>>>>>> Maven Artifacts:
>>>>>>
>>>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>>>>> <
>>>>>>
>>>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>>>>>>
>>>>>>>
>>>>>>> Distribution archives:
>>>>>> https://dist.apache.org/repos/dist/dev/logging/log4j/ <
>>>>>> https://dist.apache.org/repos/dist/dev/logging/log4j/>
>>>>>>>
>>>>>>> You may download all the Maven artifacts by executing:
>>>>>>> wget -e robots=off --cut-dirs=7 -nH -r -p -np
>>>> --no-check-certificate
>>>>>>
>>>>>
>>>> https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
>>>>>>> --
>>>>>>> Matt Sicker
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>
>>>
Re: [VOTE] Release Log4j 2.16.0-rc1
Posted by Gary Gregory <ga...@gmail.com>.
Depending on the RM's availability, I think we can proceed here.
Gary
On Mon, Dec 13, 2021 at 10:30 AM Gary Gregory <ga...@gmail.com>
wrote:
> Depending on the RM's availability
>
> On Mon, Dec 13, 2021 at 8:04 AM Gary Gregory <ga...@gmail.com>
> wrote:
>
>> +1
>>
>> mvn clean package
>> mvn apache-rat:check
>>
>> Is this command 'wrong'?
>> mvn revapi:check -pl log4j-api
>> I get errors.
>>
>> My Maven toolchain file contains mappings for Java 8, 11, 17.
>>
>> Same failure as before on Windows 10 and Java 8 in the restricted JNDI
>> test. Could be something odd with my set up I suppose.
>>
>> Darwin gdg-mac-mini.local 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13
>> 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64
>>
>> openjdk version "1.8.0_312"
>> OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
>> OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
>>
>> Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
>> Maven home: /usr/local/Cellar/maven/3.8.4/libexec
>> Java version: 1.8.0_312, vendor: Homebrew, runtime:
>> /usr/local/Cellar/openjdk@8
>> /1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
>> Default locale: en_US, platform encoding: UTF-8
>> OS name: "mac os x", version: "12.0.1", arch: "x86_64", family: "mac"
>>
>> Gary
>>
>>
>> On Mon, Dec 13, 2021 at 6:22 AM Remko Popma <re...@gmail.com>
>> wrote:
>>
>>> +1 build succeeds and tests all pass
>>>
>>> Apache Maven 3.6.2 (40f52333136460af0dc0d7232c0dc0bcf0d9e117;
>>> 2019-08-28T00:06:16+09:00)
>>> Maven home: C:\apps\apache-maven-3.6.2\bin\..
>>> Java version: 1.8.0_202, vendor: Oracle Corporation, runtime:
>>> C:\apps\jdk1.8.0_202\jre
>>> Default locale: en_GB, platform encoding: MS932
>>> OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
>>>
>>> On Mon, Dec 13, 2021 at 7:19 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
>>>
>>> > +1
>>> >
>>> > `./mvnw verify` on `log4j-2.16.0-rc1` branch passes with the following
>>> > setup:
>>> >
>>> > $ java -version
>>> > openjdk version "1.8.0_312"
>>> > OpenJDK Runtime Environment (Zulu 8.58.0.13-CA-linux64) (build
>>> > 1.8.0_312-b07)
>>> > OpenJDK 64-Bit Server VM (Zulu 8.58.0.13-CA-linux64) (build 25.312-b07,
>>> > mixed mode)
>>> >
>>> > $ java -version
>>> > openjdk version "17.0.1" 2021-10-19 LTS
>>> > OpenJDK Runtime Environment Zulu17.30+15-CA (build 17.0.1+12-LTS)
>>> > OpenJDK 64-Bit Server VM Zulu17.30+15-CA (build 17.0.1+12-LTS, mixed
>>> mode,
>>> > sharing)
>>> >
>>> > $ uname -a
>>> > Linux tahta 5.11.0-41-generic #45~20.04.1-Ubuntu SMP Wed Nov 10
>>> 10:20:10
>>> > UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
>>> >
>>> > Though I would appreciate some small fixes, which can be incorporated
>>> later
>>> > on as well:
>>> >
>>> > 1. index.md.vm contains references to 2.15.1 and misses Remko's
>>> > improvements in LOG4J2-3214
>>> > <https://issues.apache.org/jira/browse/LOG4J2-3214>
>>> > 2. security.md needs to be aligned with LOG4J2-3214
>>> > <https://issues.apache.org/jira/browse/LOG4J2-3214> too
>>> > 3. appenders.xml contains references to 2.15.1
>>> > 4. lookups.xml contains references to 2.15.1
>>> > 5. I want a link to myself in support.md too!
>>> > 6. I have encountered multiple occurrences of *"release contains one
>>> > change"* phrase, yet there are actually two changes. I would rather
>>> > rephrase this as *"release contains a limited set of changes
>>> focusing on
>>> > security"*.
>>> > 7. I have seen that CassandraAppenderIT is disabled due to aarch64
>>> > failures. I would appreciate a ticket for incorporating a
>>> > @DisabledOnArch
>>> > annotation.
>>> > 8. In Interpolator.java, there are usages of
>>> > `JndiLookup.class.getName()` and
>>> > `"org.apache.logging.log4j.core.lookup.JndiLookup"`, I'd settle on
>>> one.
>>> > 9. JNDI changes look good to me, great job Ralph!
>>> > 10. I am baffled to see that SimplePerfTest.bubbleSort() was
>>> broken, yet
>>> > tests were passing! (Thanks Matt!)
>>> >
>>> > I can actually incorporate website fixes. What is the procedure for
>>> that?
>>> > Create a `release-2.16.0` branch derived from `log4j-2.16.0-rc1` tag
>>> and
>>> > commit changes there?
>>> >
>>> > On Mon, Dec 13, 2021 at 9:02 AM Ralph Goers <
>>> ralph.goers@dslextreme.com>
>>> > wrote:
>>> >
>>> > > +1
>>> > >
>>> > > Verified the signature and the SHA512 hashes. Verified the build
>>> worked
>>> > > for me. I did correct some mistakes in the staging site home page
>>> news
>>> > > section as it still referenced 2.15.1.
>>> > >
>>> > > Ralph
>>> > >
>>> > >
>>> > > > On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com>
>>> wrote:
>>> > > >
>>> > > > This is a vote to release Log4j 2.16.0, the next version of the
>>> Log4j 2
>>> > > project.
>>> > > >
>>> > > > Please download, test, and cast your votes on the log4j developers
>>> > list.
>>> > > > [] +1, release the artifacts
>>> > > > [] -1, don't release because...
>>> > > >
>>> > > > The vote will remain open for 72 hours (or more if required). All
>>> votes
>>> > > are welcome and we encourage everyone to test the release, but only
>>> > Logging
>>> > > PMC votes are “officially” counted. As always, at least 3 +1 votes
>>> and
>>> > more
>>> > > positive than negative votes are required.
>>> > > >
>>> > > > Changes in this release include:
>>> > > >
>>> > > > Fixed Bugs
>>> > > >
>>> > > > * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi
>>> to be
>>> > > set to true to allow JNDI.
>>> > > > * LOG4J2-3211: Completely remove support for Message Lookups.
>>> > > >
>>> > > > Tag:
>>> > > > a) for a new copy do "git clone
>>> > > https://github.com/apache/logging-log4j2.git <
>>> > > https://github.com/apache/logging-log4j2.git>" and then "git
>>> checkout
>>> > > tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1
>>> > > https://github.com/apache/logging-log4j2.git <
>>> > > https://github.com/apache/logging-log4j2.git>"
>>> > > > b) for an existing working copy to “git pull” and then “git
>>> checkout
>>> > > tags/log4j-2.16.0-rc1”
>>> > > >
>>> > > > Web Site: https://logging.staged.apache.org/log4j/2.x/index.html
>>> <
>>> > > https://logging.staged.apache.org/log4j/2.x/index.html>.
>>> > > >
>>> > > > Maven Artifacts:
>>> > >
>>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>>> > <
>>> > >
>>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>>> > >
>>> > > >
>>> > > > Distribution archives:
>>> > > https://dist.apache.org/repos/dist/dev/logging/log4j/ <
>>> > > https://dist.apache.org/repos/dist/dev/logging/log4j/>
>>> > > >
>>> > > > You may download all the Maven artifacts by executing:
>>> > > > wget -e robots=off --cut-dirs=7 -nH -r -p -np
>>> --no-check-certificate
>>> > >
>>> >
>>> https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
>>> > > > --
>>> > > > Matt Sicker
>>> > > >
>>> > >
>>> > >
>>> > >
>>> >
>>>
>>
Re: [VOTE] Release Log4j 2.16.0-rc1
Posted by Gary Gregory <ga...@gmail.com>.
Depending on the RM's availability
On Mon, Dec 13, 2021 at 8:04 AM Gary Gregory <ga...@gmail.com> wrote:
> +1
>
> mvn clean package
> mvn apache-rat:check
>
> Is this command 'wrong'?
> mvn revapi:check -pl log4j-api
> I get errors.
>
> My Maven toolchain file contains mappings for Java 8, 11, 17.
>
> Same failure as before on Windows 10 and Java 8 in the restricted JNDI
> test. Could be something odd with my set up I suppose.
>
> Darwin gdg-mac-mini.local 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13
> 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64
>
> openjdk version "1.8.0_312"
> OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
> OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
>
> Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
> Maven home: /usr/local/Cellar/maven/3.8.4/libexec
> Java version: 1.8.0_312, vendor: Homebrew, runtime:
> /usr/local/Cellar/openjdk@8
> /1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "12.0.1", arch: "x86_64", family: "mac"
>
> Gary
>
>
> On Mon, Dec 13, 2021 at 6:22 AM Remko Popma <re...@gmail.com> wrote:
>
>> +1 build succeeds and tests all pass
>>
>> Apache Maven 3.6.2 (40f52333136460af0dc0d7232c0dc0bcf0d9e117;
>> 2019-08-28T00:06:16+09:00)
>> Maven home: C:\apps\apache-maven-3.6.2\bin\..
>> Java version: 1.8.0_202, vendor: Oracle Corporation, runtime:
>> C:\apps\jdk1.8.0_202\jre
>> Default locale: en_GB, platform encoding: MS932
>> OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
>>
>> On Mon, Dec 13, 2021 at 7:19 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
>>
>> > +1
>> >
>> > `./mvnw verify` on `log4j-2.16.0-rc1` branch passes with the following
>> > setup:
>> >
>> > $ java -version
>> > openjdk version "1.8.0_312"
>> > OpenJDK Runtime Environment (Zulu 8.58.0.13-CA-linux64) (build
>> > 1.8.0_312-b07)
>> > OpenJDK 64-Bit Server VM (Zulu 8.58.0.13-CA-linux64) (build 25.312-b07,
>> > mixed mode)
>> >
>> > $ java -version
>> > openjdk version "17.0.1" 2021-10-19 LTS
>> > OpenJDK Runtime Environment Zulu17.30+15-CA (build 17.0.1+12-LTS)
>> > OpenJDK 64-Bit Server VM Zulu17.30+15-CA (build 17.0.1+12-LTS, mixed
>> mode,
>> > sharing)
>> >
>> > $ uname -a
>> > Linux tahta 5.11.0-41-generic #45~20.04.1-Ubuntu SMP Wed Nov 10 10:20:10
>> > UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
>> >
>> > Though I would appreciate some small fixes, which can be incorporated
>> later
>> > on as well:
>> >
>> > 1. index.md.vm contains references to 2.15.1 and misses Remko's
>> > improvements in LOG4J2-3214
>> > <https://issues.apache.org/jira/browse/LOG4J2-3214>
>> > 2. security.md needs to be aligned with LOG4J2-3214
>> > <https://issues.apache.org/jira/browse/LOG4J2-3214> too
>> > 3. appenders.xml contains references to 2.15.1
>> > 4. lookups.xml contains references to 2.15.1
>> > 5. I want a link to myself in support.md too!
>> > 6. I have encountered multiple occurrences of *"release contains one
>> > change"* phrase, yet there are actually two changes. I would rather
>> > rephrase this as *"release contains a limited set of changes
>> focusing on
>> > security"*.
>> > 7. I have seen that CassandraAppenderIT is disabled due to aarch64
>> > failures. I would appreciate a ticket for incorporating a
>> > @DisabledOnArch
>> > annotation.
>> > 8. In Interpolator.java, there are usages of
>> > `JndiLookup.class.getName()` and
>> > `"org.apache.logging.log4j.core.lookup.JndiLookup"`, I'd settle on
>> one.
>> > 9. JNDI changes look good to me, great job Ralph!
>> > 10. I am baffled to see that SimplePerfTest.bubbleSort() was broken,
>> yet
>> > tests were passing! (Thanks Matt!)
>> >
>> > I can actually incorporate website fixes. What is the procedure for
>> that?
>> > Create a `release-2.16.0` branch derived from `log4j-2.16.0-rc1` tag and
>> > commit changes there?
>> >
>> > On Mon, Dec 13, 2021 at 9:02 AM Ralph Goers <ralph.goers@dslextreme.com
>> >
>> > wrote:
>> >
>> > > +1
>> > >
>> > > Verified the signature and the SHA512 hashes. Verified the build
>> worked
>> > > for me. I did correct some mistakes in the staging site home page news
>> > > section as it still referenced 2.15.1.
>> > >
>> > > Ralph
>> > >
>> > >
>> > > > On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com> wrote:
>> > > >
>> > > > This is a vote to release Log4j 2.16.0, the next version of the
>> Log4j 2
>> > > project.
>> > > >
>> > > > Please download, test, and cast your votes on the log4j developers
>> > list.
>> > > > [] +1, release the artifacts
>> > > > [] -1, don't release because...
>> > > >
>> > > > The vote will remain open for 72 hours (or more if required). All
>> votes
>> > > are welcome and we encourage everyone to test the release, but only
>> > Logging
>> > > PMC votes are “officially” counted. As always, at least 3 +1 votes and
>> > more
>> > > positive than negative votes are required.
>> > > >
>> > > > Changes in this release include:
>> > > >
>> > > > Fixed Bugs
>> > > >
>> > > > * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi
>> to be
>> > > set to true to allow JNDI.
>> > > > * LOG4J2-3211: Completely remove support for Message Lookups.
>> > > >
>> > > > Tag:
>> > > > a) for a new copy do "git clone
>> > > https://github.com/apache/logging-log4j2.git <
>> > > https://github.com/apache/logging-log4j2.git>" and then "git checkout
>> > > tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1
>> > > https://github.com/apache/logging-log4j2.git <
>> > > https://github.com/apache/logging-log4j2.git>"
>> > > > b) for an existing working copy to “git pull” and then “git checkout
>> > > tags/log4j-2.16.0-rc1”
>> > > >
>> > > > Web Site: https://logging.staged.apache.org/log4j/2.x/index.html <
>> > > https://logging.staged.apache.org/log4j/2.x/index.html>.
>> > > >
>> > > > Maven Artifacts:
>> > >
>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>> > <
>> > >
>> https://repository.apache.org/content/repositories/orgapachelogging-1068
>> > >
>> > > >
>> > > > Distribution archives:
>> > > https://dist.apache.org/repos/dist/dev/logging/log4j/ <
>> > > https://dist.apache.org/repos/dist/dev/logging/log4j/>
>> > > >
>> > > > You may download all the Maven artifacts by executing:
>> > > > wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate
>> > >
>> >
>> https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
>> > > > --
>> > > > Matt Sicker
>> > > >
>> > >
>> > >
>> > >
>> >
>>
>
Re: [VOTE] Release Log4j 2.16.0-rc1
Posted by Gary Gregory <ga...@gmail.com>.
+1
mvn clean package
mvn apache-rat:check
Is this command 'wrong'?
mvn revapi:check -pl log4j-api
I get errors.
My Maven toolchain file contains mappings for Java 8, 11, 17.
Same failure as before on Windows 10 and Java 8 in the restricted JNDI
test. Could be something odd with my set up I suppose.
Darwin gdg-mac-mini.local 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13
17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64
openjdk version "1.8.0_312"
OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
Maven home: /usr/local/Cellar/maven/3.8.4/libexec
Java version: 1.8.0_312, vendor: Homebrew, runtime:
/usr/local/Cellar/openjdk@8/1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "12.0.1", arch: "x86_64", family: "mac"
Gary
On Mon, Dec 13, 2021 at 6:22 AM Remko Popma <re...@gmail.com> wrote:
> +1 build succeeds and tests all pass
>
> Apache Maven 3.6.2 (40f52333136460af0dc0d7232c0dc0bcf0d9e117;
> 2019-08-28T00:06:16+09:00)
> Maven home: C:\apps\apache-maven-3.6.2\bin\..
> Java version: 1.8.0_202, vendor: Oracle Corporation, runtime:
> C:\apps\jdk1.8.0_202\jre
> Default locale: en_GB, platform encoding: MS932
> OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
>
> On Mon, Dec 13, 2021 at 7:19 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> > +1
> >
> > `./mvnw verify` on `log4j-2.16.0-rc1` branch passes with the following
> > setup:
> >
> > $ java -version
> > openjdk version "1.8.0_312"
> > OpenJDK Runtime Environment (Zulu 8.58.0.13-CA-linux64) (build
> > 1.8.0_312-b07)
> > OpenJDK 64-Bit Server VM (Zulu 8.58.0.13-CA-linux64) (build 25.312-b07,
> > mixed mode)
> >
> > $ java -version
> > openjdk version "17.0.1" 2021-10-19 LTS
> > OpenJDK Runtime Environment Zulu17.30+15-CA (build 17.0.1+12-LTS)
> > OpenJDK 64-Bit Server VM Zulu17.30+15-CA (build 17.0.1+12-LTS, mixed
> mode,
> > sharing)
> >
> > $ uname -a
> > Linux tahta 5.11.0-41-generic #45~20.04.1-Ubuntu SMP Wed Nov 10 10:20:10
> > UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
> >
> > Though I would appreciate some small fixes, which can be incorporated
> later
> > on as well:
> >
> > 1. index.md.vm contains references to 2.15.1 and misses Remko's
> > improvements in LOG4J2-3214
> > <https://issues.apache.org/jira/browse/LOG4J2-3214>
> > 2. security.md needs to be aligned with LOG4J2-3214
> > <https://issues.apache.org/jira/browse/LOG4J2-3214> too
> > 3. appenders.xml contains references to 2.15.1
> > 4. lookups.xml contains references to 2.15.1
> > 5. I want a link to myself in support.md too!
> > 6. I have encountered multiple occurrences of *"release contains one
> > change"* phrase, yet there are actually two changes. I would rather
> > rephrase this as *"release contains a limited set of changes focusing
> on
> > security"*.
> > 7. I have seen that CassandraAppenderIT is disabled due to aarch64
> > failures. I would appreciate a ticket for incorporating a
> > @DisabledOnArch
> > annotation.
> > 8. In Interpolator.java, there are usages of
> > `JndiLookup.class.getName()` and
> > `"org.apache.logging.log4j.core.lookup.JndiLookup"`, I'd settle on
> one.
> > 9. JNDI changes look good to me, great job Ralph!
> > 10. I am baffled to see that SimplePerfTest.bubbleSort() was broken,
> yet
> > tests were passing! (Thanks Matt!)
> >
> > I can actually incorporate website fixes. What is the procedure for that?
> > Create a `release-2.16.0` branch derived from `log4j-2.16.0-rc1` tag and
> > commit changes there?
> >
> > On Mon, Dec 13, 2021 at 9:02 AM Ralph Goers <ra...@dslextreme.com>
> > wrote:
> >
> > > +1
> > >
> > > Verified the signature and the SHA512 hashes. Verified the build worked
> > > for me. I did correct some mistakes in the staging site home page news
> > > section as it still referenced 2.15.1.
> > >
> > > Ralph
> > >
> > >
> > > > On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com> wrote:
> > > >
> > > > This is a vote to release Log4j 2.16.0, the next version of the
> Log4j 2
> > > project.
> > > >
> > > > Please download, test, and cast your votes on the log4j developers
> > list.
> > > > [] +1, release the artifacts
> > > > [] -1, don't release because...
> > > >
> > > > The vote will remain open for 72 hours (or more if required). All
> votes
> > > are welcome and we encourage everyone to test the release, but only
> > Logging
> > > PMC votes are “officially” counted. As always, at least 3 +1 votes and
> > more
> > > positive than negative votes are required.
> > > >
> > > > Changes in this release include:
> > > >
> > > > Fixed Bugs
> > > >
> > > > * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi to
> be
> > > set to true to allow JNDI.
> > > > * LOG4J2-3211: Completely remove support for Message Lookups.
> > > >
> > > > Tag:
> > > > a) for a new copy do "git clone
> > > https://github.com/apache/logging-log4j2.git <
> > > https://github.com/apache/logging-log4j2.git>" and then "git checkout
> > > tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1
> > > https://github.com/apache/logging-log4j2.git <
> > > https://github.com/apache/logging-log4j2.git>"
> > > > b) for an existing working copy to “git pull” and then “git checkout
> > > tags/log4j-2.16.0-rc1”
> > > >
> > > > Web Site: https://logging.staged.apache.org/log4j/2.x/index.html <
> > > https://logging.staged.apache.org/log4j/2.x/index.html>.
> > > >
> > > > Maven Artifacts:
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1068
> > <
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1068
> > >
> > > >
> > > > Distribution archives:
> > > https://dist.apache.org/repos/dist/dev/logging/log4j/ <
> > > https://dist.apache.org/repos/dist/dev/logging/log4j/>
> > > >
> > > > You may download all the Maven artifacts by executing:
> > > > wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate
> > >
> >
> https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
> > > > --
> > > > Matt Sicker
> > > >
> > >
> > >
> > >
> >
>
Re: [VOTE] Release Log4j 2.16.0-rc1
Posted by Remko Popma <re...@gmail.com>.
+1 build succeeds and tests all pass
Apache Maven 3.6.2 (40f52333136460af0dc0d7232c0dc0bcf0d9e117;
2019-08-28T00:06:16+09:00)
Maven home: C:\apps\apache-maven-3.6.2\bin\..
Java version: 1.8.0_202, vendor: Oracle Corporation, runtime:
C:\apps\jdk1.8.0_202\jre
Default locale: en_GB, platform encoding: MS932
OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
On Mon, Dec 13, 2021 at 7:19 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
> +1
>
> `./mvnw verify` on `log4j-2.16.0-rc1` branch passes with the following
> setup:
>
> $ java -version
> openjdk version "1.8.0_312"
> OpenJDK Runtime Environment (Zulu 8.58.0.13-CA-linux64) (build
> 1.8.0_312-b07)
> OpenJDK 64-Bit Server VM (Zulu 8.58.0.13-CA-linux64) (build 25.312-b07,
> mixed mode)
>
> $ java -version
> openjdk version "17.0.1" 2021-10-19 LTS
> OpenJDK Runtime Environment Zulu17.30+15-CA (build 17.0.1+12-LTS)
> OpenJDK 64-Bit Server VM Zulu17.30+15-CA (build 17.0.1+12-LTS, mixed mode,
> sharing)
>
> $ uname -a
> Linux tahta 5.11.0-41-generic #45~20.04.1-Ubuntu SMP Wed Nov 10 10:20:10
> UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
>
> Though I would appreciate some small fixes, which can be incorporated later
> on as well:
>
> 1. index.md.vm contains references to 2.15.1 and misses Remko's
> improvements in LOG4J2-3214
> <https://issues.apache.org/jira/browse/LOG4J2-3214>
> 2. security.md needs to be aligned with LOG4J2-3214
> <https://issues.apache.org/jira/browse/LOG4J2-3214> too
> 3. appenders.xml contains references to 2.15.1
> 4. lookups.xml contains references to 2.15.1
> 5. I want a link to myself in support.md too!
> 6. I have encountered multiple occurrences of *"release contains one
> change"* phrase, yet there are actually two changes. I would rather
> rephrase this as *"release contains a limited set of changes focusing on
> security"*.
> 7. I have seen that CassandraAppenderIT is disabled due to aarch64
> failures. I would appreciate a ticket for incorporating a
> @DisabledOnArch
> annotation.
> 8. In Interpolator.java, there are usages of
> `JndiLookup.class.getName()` and
> `"org.apache.logging.log4j.core.lookup.JndiLookup"`, I'd settle on one.
> 9. JNDI changes look good to me, great job Ralph!
> 10. I am baffled to see that SimplePerfTest.bubbleSort() was broken, yet
> tests were passing! (Thanks Matt!)
>
> I can actually incorporate website fixes. What is the procedure for that?
> Create a `release-2.16.0` branch derived from `log4j-2.16.0-rc1` tag and
> commit changes there?
>
> On Mon, Dec 13, 2021 at 9:02 AM Ralph Goers <ra...@dslextreme.com>
> wrote:
>
> > +1
> >
> > Verified the signature and the SHA512 hashes. Verified the build worked
> > for me. I did correct some mistakes in the staging site home page news
> > section as it still referenced 2.15.1.
> >
> > Ralph
> >
> >
> > > On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com> wrote:
> > >
> > > This is a vote to release Log4j 2.16.0, the next version of the Log4j 2
> > project.
> > >
> > > Please download, test, and cast your votes on the log4j developers
> list.
> > > [] +1, release the artifacts
> > > [] -1, don't release because...
> > >
> > > The vote will remain open for 72 hours (or more if required). All votes
> > are welcome and we encourage everyone to test the release, but only
> Logging
> > PMC votes are “officially” counted. As always, at least 3 +1 votes and
> more
> > positive than negative votes are required.
> > >
> > > Changes in this release include:
> > >
> > > Fixed Bugs
> > >
> > > * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi to be
> > set to true to allow JNDI.
> > > * LOG4J2-3211: Completely remove support for Message Lookups.
> > >
> > > Tag:
> > > a) for a new copy do "git clone
> > https://github.com/apache/logging-log4j2.git <
> > https://github.com/apache/logging-log4j2.git>" and then "git checkout
> > tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1
> > https://github.com/apache/logging-log4j2.git <
> > https://github.com/apache/logging-log4j2.git>"
> > > b) for an existing working copy to “git pull” and then “git checkout
> > tags/log4j-2.16.0-rc1”
> > >
> > > Web Site: https://logging.staged.apache.org/log4j/2.x/index.html <
> > https://logging.staged.apache.org/log4j/2.x/index.html>.
> > >
> > > Maven Artifacts:
> > https://repository.apache.org/content/repositories/orgapachelogging-1068
> <
> > https://repository.apache.org/content/repositories/orgapachelogging-1068
> >
> > >
> > > Distribution archives:
> > https://dist.apache.org/repos/dist/dev/logging/log4j/ <
> > https://dist.apache.org/repos/dist/dev/logging/log4j/>
> > >
> > > You may download all the Maven artifacts by executing:
> > > wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate
> >
> https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
> > > --
> > > Matt Sicker
> > >
> >
> >
> >
>
Re: [VOTE] Release Log4j 2.16.0-rc1
Posted by Volkan Yazıcı <vo...@yazi.ci>.
+1
`./mvnw verify` on `log4j-2.16.0-rc1` branch passes with the following
setup:
$ java -version
openjdk version "1.8.0_312"
OpenJDK Runtime Environment (Zulu 8.58.0.13-CA-linux64) (build
1.8.0_312-b07)
OpenJDK 64-Bit Server VM (Zulu 8.58.0.13-CA-linux64) (build 25.312-b07,
mixed mode)
$ java -version
openjdk version "17.0.1" 2021-10-19 LTS
OpenJDK Runtime Environment Zulu17.30+15-CA (build 17.0.1+12-LTS)
OpenJDK 64-Bit Server VM Zulu17.30+15-CA (build 17.0.1+12-LTS, mixed mode,
sharing)
$ uname -a
Linux tahta 5.11.0-41-generic #45~20.04.1-Ubuntu SMP Wed Nov 10 10:20:10
UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Though I would appreciate some small fixes, which can be incorporated later
on as well:
1. index.md.vm contains references to 2.15.1 and misses Remko's
improvements in LOG4J2-3214
<https://issues.apache.org/jira/browse/LOG4J2-3214>
2. security.md needs to be aligned with LOG4J2-3214
<https://issues.apache.org/jira/browse/LOG4J2-3214> too
3. appenders.xml contains references to 2.15.1
4. lookups.xml contains references to 2.15.1
5. I want a link to myself in support.md too!
6. I have encountered multiple occurrences of *"release contains one
change"* phrase, yet there are actually two changes. I would rather
rephrase this as *"release contains a limited set of changes focusing on
security"*.
7. I have seen that CassandraAppenderIT is disabled due to aarch64
failures. I would appreciate a ticket for incorporating a @DisabledOnArch
annotation.
8. In Interpolator.java, there are usages of
`JndiLookup.class.getName()` and
`"org.apache.logging.log4j.core.lookup.JndiLookup"`, I'd settle on one.
9. JNDI changes look good to me, great job Ralph!
10. I am baffled to see that SimplePerfTest.bubbleSort() was broken, yet
tests were passing! (Thanks Matt!)
I can actually incorporate website fixes. What is the procedure for that?
Create a `release-2.16.0` branch derived from `log4j-2.16.0-rc1` tag and
commit changes there?
On Mon, Dec 13, 2021 at 9:02 AM Ralph Goers <ra...@dslextreme.com>
wrote:
> +1
>
> Verified the signature and the SHA512 hashes. Verified the build worked
> for me. I did correct some mistakes in the staging site home page news
> section as it still referenced 2.15.1.
>
> Ralph
>
>
> > On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com> wrote:
> >
> > This is a vote to release Log4j 2.16.0, the next version of the Log4j 2
> project.
> >
> > Please download, test, and cast your votes on the log4j developers list.
> > [] +1, release the artifacts
> > [] -1, don't release because...
> >
> > The vote will remain open for 72 hours (or more if required). All votes
> are welcome and we encourage everyone to test the release, but only Logging
> PMC votes are “officially” counted. As always, at least 3 +1 votes and more
> positive than negative votes are required.
> >
> > Changes in this release include:
> >
> > Fixed Bugs
> >
> > * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi to be
> set to true to allow JNDI.
> > * LOG4J2-3211: Completely remove support for Message Lookups.
> >
> > Tag:
> > a) for a new copy do "git clone
> https://github.com/apache/logging-log4j2.git <
> https://github.com/apache/logging-log4j2.git>" and then "git checkout
> tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1
> https://github.com/apache/logging-log4j2.git <
> https://github.com/apache/logging-log4j2.git>"
> > b) for an existing working copy to “git pull” and then “git checkout
> tags/log4j-2.16.0-rc1”
> >
> > Web Site: https://logging.staged.apache.org/log4j/2.x/index.html <
> https://logging.staged.apache.org/log4j/2.x/index.html>.
> >
> > Maven Artifacts:
> https://repository.apache.org/content/repositories/orgapachelogging-1068 <
> https://repository.apache.org/content/repositories/orgapachelogging-1068>
> >
> > Distribution archives:
> https://dist.apache.org/repos/dist/dev/logging/log4j/ <
> https://dist.apache.org/repos/dist/dev/logging/log4j/>
> >
> > You may download all the Maven artifacts by executing:
> > wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate
> https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
> > --
> > Matt Sicker
> >
>
>
>
Re: [VOTE] Release Log4j 2.16.0-rc1
Posted by Ralph Goers <ra...@dslextreme.com>.
+1
Verified the signature and the SHA512 hashes. Verified the build worked for me. I did correct some mistakes in the staging site home page news section as it still referenced 2.15.1.
Ralph
> On Dec 12, 2021, at 11:18 PM, Matt Sicker <bo...@gmail.com> wrote:
>
> This is a vote to release Log4j 2.16.0, the next version of the Log4j 2 project.
>
> Please download, test, and cast your votes on the log4j developers list.
> [] +1, release the artifacts
> [] -1, don't release because...
>
> The vote will remain open for 72 hours (or more if required). All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
>
> Changes in this release include:
>
> Fixed Bugs
>
> * LOG4J2-3208: Disable JNDI by default. Require log4j2.enableJndi to be set to true to allow JNDI.
> * LOG4J2-3211: Completely remove support for Message Lookups.
>
> Tag:
> a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git <https://github.com/apache/logging-log4j2.git>" and then "git checkout tags/log4j-2.16.0-rc1” or just "git clone -b log4j-2.16.0-rc1 https://github.com/apache/logging-log4j2.git <https://github.com/apache/logging-log4j2.git>"
> b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.16.0-rc1”
>
> Web Site: https://logging.staged.apache.org/log4j/2.x/index.html <https://logging.staged.apache.org/log4j/2.x/index.html>.
>
> Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1068 <https://repository.apache.org/content/repositories/orgapachelogging-1068>
>
> Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/ <https://dist.apache.org/repos/dist/dev/logging/log4j/>
>
> You may download all the Maven artifacts by executing:
> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1068/org/apache/logging/log4j/
> --
> Matt Sicker
>