You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by Ralph Goers <ra...@dslextreme.com> on 2021/12/21 00:52:47 UTC
[VOTE] Release Apache Log4j 2.12.3-rc1
This is a vote to release Log4j 2.12.3, a security release for Java 7 users.
Please download, test, and cast your votes on the log4j developers list.
[] +1, release the artifacts
[] -1, don't release because...
The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
Changes in this version include:
Fixed Bugs
• LOG4J2-3230: Fix string substitution recursion.
• LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector’.
• LOG4J2-2819: Add support for specifying an SSL configuration for SmtpAppender
Tag:
a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git" and then "git checkout tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1 https://github.com/apache/logging-log4j2.git"
b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.12.3-rc1”
Web Site: https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1074
Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/
You may download all the Maven artifacts by executing:
wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/.
Re: [VOTE] Release Apache Log4j 2.12.3-rc1
Posted by Ralph Goers <ra...@dslextreme.com>.
My +1
Ralph
> On Dec 20, 2021, at 5:52 PM, Ralph Goers <ra...@dslextreme.com> wrote:
>
> This is a vote to release Log4j 2.12.3, a security release for Java 7 users.
>
> Please download, test, and cast your votes on the log4j developers list.
> [] +1, release the artifacts
> [] -1, don't release because...
>
> The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
>
> Changes in this version include:
>
> Fixed Bugs
>
> • LOG4J2-3230: Fix string substitution recursion.
> • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector’.
> • LOG4J2-2819: Add support for specifying an SSL configuration for SmtpAppender
>
> Tag:
> a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git" and then "git checkout tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1 https://github.com/apache/logging-log4j2.git"
> b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.12.3-rc1”
>
> Web Site: https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
>
> Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1074
>
> Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/
>
> You may download all the Maven artifacts by executing:
> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/.
Re: [VOTE] Release Apache Log4j 2.12.3-rc1
Posted by Gary Gregory <ga...@gmail.com>.
+1 then
Gary
On Mon, Dec 20, 2021 at 10:50 PM Ralph Goers <ra...@dslextreme.com> wrote:
>
> There was a bug in the site build. I checked the fix in to the branch. It doesn’t matter for the release.
>
> Ralph
>
> > On Dec 20, 2021, at 6:46 PM, Gary Gregory <ga...@gmail.com> wrote:
> >
> > Building from the git tag for HEAD detached at log4j-2.12.3-rc1 (2b9359b23)
> >
> > - mvn apache-rat:check -DskipTests OK
> > - mvn clean install OK except a JVM crash I always get in the
> > Cassandra module tests, just like always.
> > - mvn site -DskipTests fails with:
> >
> > [ERROR] Failed to execute goal
> > org.apache.maven.plugins:maven-site-plugin:3.4:site (default-site) on
> > project log4j: Error parsing
> > '/Users/garydgregory/git/logging-log4j-2.12/src/site/xdoc/manual/appenders.xml':
> > line [1713] Error parsing the model: end tag name </subsection> must
> > match start tag name <p> from line 1533 (position: TEXT seen
> > ...</pre>\n\n </subsection>... @1713:22) -> [Help 1]
> >
> > Is that just me?
> >
> > Built with:
> >
> > openjdk version "1.8.0_312"
> > OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
> > OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
> >
> > Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
> > Maven home: /usr/local/Cellar/maven/3.8.4/libexec
> > Java version: 1.8.0_312, vendor: Homebrew, runtime:
> > /usr/local/Cellar/openjdk@8/1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
> > Default locale: en_US, platform encoding: UTF-8
> > OS name: "mac os x", version: "12.1", arch: "x86_64", family: "mac"
> >
> > Darwin *** 21.2.0 Darwin Kernel Version 21.2.0: Sun Nov 28 20:28:54
> > PST 2021; root:xnu-8019.61.5~1/RELEASE_X86_64 x86_64
> >
> > Gary
> >
> > On Mon, Dec 20, 2021 at 7:52 PM Ralph Goers <ra...@dslextreme.com> wrote:
> >>
> >> This is a vote to release Log4j 2.12.3, a security release for Java 7 users.
> >>
> >> Please download, test, and cast your votes on the log4j developers list.
> >> [] +1, release the artifacts
> >> [] -1, don't release because...
> >>
> >> The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
> >>
> >> Changes in this version include:
> >>
> >> Fixed Bugs
> >>
> >> • LOG4J2-3230: Fix string substitution recursion.
> >> • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector’.
> >> • LOG4J2-2819: Add support for specifying an SSL configuration for SmtpAppender
> >>
> >> Tag:
> >> a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git" and then "git checkout tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1 https://github.com/apache/logging-log4j2.git"
> >> b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.12.3-rc1”
> >>
> >> Web Site: https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
> >>
> >> Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1074
> >>
> >> Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/
> >>
> >> You may download all the Maven artifacts by executing:
> >> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/.
> >
>
Re: [VOTE] Release Apache Log4j 2.12.3-rc1
Posted by Ralph Goers <ra...@dslextreme.com>.
There was a bug in the site build. I checked the fix in to the branch. It doesn’t matter for the release.
Ralph
> On Dec 20, 2021, at 6:46 PM, Gary Gregory <ga...@gmail.com> wrote:
>
> Building from the git tag for HEAD detached at log4j-2.12.3-rc1 (2b9359b23)
>
> - mvn apache-rat:check -DskipTests OK
> - mvn clean install OK except a JVM crash I always get in the
> Cassandra module tests, just like always.
> - mvn site -DskipTests fails with:
>
> [ERROR] Failed to execute goal
> org.apache.maven.plugins:maven-site-plugin:3.4:site (default-site) on
> project log4j: Error parsing
> '/Users/garydgregory/git/logging-log4j-2.12/src/site/xdoc/manual/appenders.xml':
> line [1713] Error parsing the model: end tag name </subsection> must
> match start tag name <p> from line 1533 (position: TEXT seen
> ...</pre>\n\n </subsection>... @1713:22) -> [Help 1]
>
> Is that just me?
>
> Built with:
>
> openjdk version "1.8.0_312"
> OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
> OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
>
> Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
> Maven home: /usr/local/Cellar/maven/3.8.4/libexec
> Java version: 1.8.0_312, vendor: Homebrew, runtime:
> /usr/local/Cellar/openjdk@8/1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "12.1", arch: "x86_64", family: "mac"
>
> Darwin *** 21.2.0 Darwin Kernel Version 21.2.0: Sun Nov 28 20:28:54
> PST 2021; root:xnu-8019.61.5~1/RELEASE_X86_64 x86_64
>
> Gary
>
> On Mon, Dec 20, 2021 at 7:52 PM Ralph Goers <ra...@dslextreme.com> wrote:
>>
>> This is a vote to release Log4j 2.12.3, a security release for Java 7 users.
>>
>> Please download, test, and cast your votes on the log4j developers list.
>> [] +1, release the artifacts
>> [] -1, don't release because...
>>
>> The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
>>
>> Changes in this version include:
>>
>> Fixed Bugs
>>
>> • LOG4J2-3230: Fix string substitution recursion.
>> • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector’.
>> • LOG4J2-2819: Add support for specifying an SSL configuration for SmtpAppender
>>
>> Tag:
>> a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git" and then "git checkout tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1 https://github.com/apache/logging-log4j2.git"
>> b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.12.3-rc1”
>>
>> Web Site: https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
>>
>> Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1074
>>
>> Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/
>>
>> You may download all the Maven artifacts by executing:
>> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/.
>
Re: [VOTE] Release Apache Log4j 2.12.3-rc1
Posted by Gary Gregory <ga...@gmail.com>.
Building from the git tag for HEAD detached at log4j-2.12.3-rc1 (2b9359b23)
- mvn apache-rat:check -DskipTests OK
- mvn clean install OK except a JVM crash I always get in the
Cassandra module tests, just like always.
- mvn site -DskipTests fails with:
[ERROR] Failed to execute goal
org.apache.maven.plugins:maven-site-plugin:3.4:site (default-site) on
project log4j: Error parsing
'/Users/garydgregory/git/logging-log4j-2.12/src/site/xdoc/manual/appenders.xml':
line [1713] Error parsing the model: end tag name </subsection> must
match start tag name <p> from line 1533 (position: TEXT seen
...</pre>\n\n </subsection>... @1713:22) -> [Help 1]
Is that just me?
Built with:
openjdk version "1.8.0_312"
OpenJDK Runtime Environment (build 1.8.0_312-bre_2021_10_20_23_15-b00)
OpenJDK 64-Bit Server VM (build 25.312-b00, mixed mode)
Apache Maven 3.8.4 (9b656c72d54e5bacbed989b64718c159fe39b537)
Maven home: /usr/local/Cellar/maven/3.8.4/libexec
Java version: 1.8.0_312, vendor: Homebrew, runtime:
/usr/local/Cellar/openjdk@8/1.8.0+312/libexec/openjdk.jdk/Contents/Home/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "12.1", arch: "x86_64", family: "mac"
Darwin *** 21.2.0 Darwin Kernel Version 21.2.0: Sun Nov 28 20:28:54
PST 2021; root:xnu-8019.61.5~1/RELEASE_X86_64 x86_64
Gary
On Mon, Dec 20, 2021 at 7:52 PM Ralph Goers <ra...@dslextreme.com> wrote:
>
> This is a vote to release Log4j 2.12.3, a security release for Java 7 users.
>
> Please download, test, and cast your votes on the log4j developers list.
> [] +1, release the artifacts
> [] -1, don't release because...
>
> The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
>
> Changes in this version include:
>
> Fixed Bugs
>
> • LOG4J2-3230: Fix string substitution recursion.
> • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector’.
> • LOG4J2-2819: Add support for specifying an SSL configuration for SmtpAppender
>
> Tag:
> a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git" and then "git checkout tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1 https://github.com/apache/logging-log4j2.git"
> b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.12.3-rc1”
>
> Web Site: https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
>
> Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1074
>
> Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/
>
> You may download all the Maven artifacts by executing:
> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/.
Re: [VOTE] Release Apache Log4j 2.12.3-rc1
Posted by Remko Popma <re...@gmail.com>.
+1
Remko
On Tue, Dec 21, 2021 at 12:52 PM Carter Kozak <ck...@ckozak.net> wrote:
> +1
>
> -ck
>
> > On Dec 20, 2021, at 22:46, Matt Sicker <bo...@gmail.com> wrote:
> >
> > +1
> >
> > Notes on the release:
> > * Sigs and checksums good
> > * Builds and tests fine
> > * Outdated copyright year in NOTICE.txt
> >
> > --
> > Matt Sicker
> >
> >> On Dec 20, 2021, at 18:52, Ralph Goers <ra...@dslextreme.com>
> wrote:
> >>
> >> This is a vote to release Log4j 2.12.3, a security release for Java 7
> users.
> >>
> >> Please download, test, and cast your votes on the log4j developers list.
> >> [] +1, release the artifacts
> >> [] -1, don't release because...
> >>
> >> The vote will remain open for as short amount as time as required to
> vet the release. All votes are welcome and we encourage everyone to test
> the release, but only Logging PMC votes are “officially” counted. As
> always, at least 3 +1 votes and more positive than negative votes are
> required.
> >>
> >> Changes in this version include:
> >>
> >> Fixed Bugs
> >>
> >> • LOG4J2-3230: Fix string substitution recursion.
> >> • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will
> remain disabled by default. Rename JNDI enablement property from
> 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms',
> and 'log4j2.enableJndiContextSelector’.
> >> • LOG4J2-2819: Add support for specifying an SSL configuration
> for SmtpAppender
> >>
> >> Tag:
> >> a) for a new copy do "git clone
> https://github.com/apache/logging-log4j2.git" and then "git checkout
> tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1
> https://github.com/apache/logging-log4j2.git"
> >> b) for an existing working copy to “git pull” and then “git checkout
> tags/log4j-2.12.3-rc1”
> >>
> >> Web Site:
> https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
> >>
> >> Maven Artifacts:
> https://repository.apache.org/content/repositories/orgapachelogging-1074
> >>
> >> Distribution archives:
> https://dist.apache.org/repos/dist/dev/logging/log4j/
> >>
> >> You may download all the Maven artifacts by executing:
> >> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate
> https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/
> .
> >
>
>
Re: [VOTE] Release Apache Log4j 2.12.3-rc1
Posted by Carter Kozak <ck...@ckozak.net>.
+1
-ck
> On Dec 20, 2021, at 22:46, Matt Sicker <bo...@gmail.com> wrote:
>
> +1
>
> Notes on the release:
> * Sigs and checksums good
> * Builds and tests fine
> * Outdated copyright year in NOTICE.txt
>
> --
> Matt Sicker
>
>> On Dec 20, 2021, at 18:52, Ralph Goers <ra...@dslextreme.com> wrote:
>>
>> This is a vote to release Log4j 2.12.3, a security release for Java 7 users.
>>
>> Please download, test, and cast your votes on the log4j developers list.
>> [] +1, release the artifacts
>> [] -1, don't release because...
>>
>> The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
>>
>> Changes in this version include:
>>
>> Fixed Bugs
>>
>> • LOG4J2-3230: Fix string substitution recursion.
>> • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector’.
>> • LOG4J2-2819: Add support for specifying an SSL configuration for SmtpAppender
>>
>> Tag:
>> a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git" and then "git checkout tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1 https://github.com/apache/logging-log4j2.git"
>> b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.12.3-rc1”
>>
>> Web Site: https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
>>
>> Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1074
>>
>> Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/
>>
>> You may download all the Maven artifacts by executing:
>> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/.
>
Re: [VOTE] Release Apache Log4j 2.12.3-rc1
Posted by Matt Sicker <bo...@gmail.com>.
+1
Notes on the release:
* Sigs and checksums good
* Builds and tests fine
* Outdated copyright year in NOTICE.txt
--
Matt Sicker
> On Dec 20, 2021, at 18:52, Ralph Goers <ra...@dslextreme.com> wrote:
>
> This is a vote to release Log4j 2.12.3, a security release for Java 7 users.
>
> Please download, test, and cast your votes on the log4j developers list.
> [] +1, release the artifacts
> [] -1, don't release because...
>
> The vote will remain open for as short amount as time as required to vet the release. All votes are welcome and we encourage everyone to test the release, but only Logging PMC votes are “officially” counted. As always, at least 3 +1 votes and more positive than negative votes are required.
>
> Changes in this version include:
>
> Fixed Bugs
>
> • LOG4J2-3230: Fix string substitution recursion.
> • LOG4J2-3242: Limit JNDI to the java protocol only. JNDI will remain disabled by default. Rename JNDI enablement property from 'log4j2.enableJndi' to 'log4j2.enableJndiLookup', 'log4j2.enableJndiJms', and 'log4j2.enableJndiContextSelector’.
> • LOG4J2-2819: Add support for specifying an SSL configuration for SmtpAppender
>
> Tag:
> a) for a new copy do "git clone https://github.com/apache/logging-log4j2.git" and then "git checkout tags/log4j-2.12.3-rc1” or just "git clone -b log4j-2.12.3-rc1 https://github.com/apache/logging-log4j2.git"
> b) for an existing working copy to “git pull” and then “git checkout tags/log4j-2.12.3-rc1”
>
> Web Site: https://logging.staged.apache.org/log4j/log4j-2.12.3/index.html
>
> Maven Artifacts: https://repository.apache.org/content/repositories/orgapachelogging-1074
>
> Distribution archives: https://dist.apache.org/repos/dist/dev/logging/log4j/
>
> You may download all the Maven artifacts by executing:
> wget -e robots=off --cut-dirs=7 -nH -r -p -np --no-check-certificate https://repository.apache.org/content/repositories/orgapachelogging-1074/org/apache/logging/log4j/.