You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by "Piotr P. Karwasz" <pi...@gmail.com> on 2023/12/22 18:00:16 UTC
[VOTE] Release Apache Log4j 2.22.1 RC1
This is a vote to release the Apache Log4j 2.22.1.
Website: https://logging.staged.apache.org/log4j/2.x/
GitHub: https://github.com/apache/logging-log4j2
Commit: 8469975a4f2b1f8f1bd4f25ca6d1989a52aefc1b
Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1254
Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
Please download, test, and cast your votes on this mailing list.
[ ] +1, release the artifacts
[ ] -1, don't release, because...
This vote is open for 72 hours and will pass unless getting a
net negative vote count. All votes are welcome and we encourage
everyone to test the release, but only the Logging Services PMC
votes are officially counted.
== Review Kit
The minimum set of steps needed to review the uploaded distribution
files in the Subversion repository can be summarized as follows:
# Check out the distribution
wget --recursive --no-parent --no-host-directories --cut-dirs=5
https://dist.apache.org/repos/dist/dev/logging/log4j
# Verify checksums
sha512sum --check *.sha512
# Verify signatures
wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
for sigFile in *.asc; do gpg --verify $sigFile; done
# Verify reproduciblity
umask 0022
unzip *-src.zip -d src
cd src
export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1254
sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
== Release Notes
This release contains only dependency upgrades and bug fixes, which do
not change the behavior of the artifacts.
While maintaining compatibility with Java 8, the artifacts in this
release where generated using JDK 17, unlike version `2.22.0` that
used JDK 11.
[#release-notes-2-22-1-fixed]
=== Fixed
* Mark `JdkMapAdapterStringMap` as frozen if map is immutable. (#2098)
* Fix NPE in `CloseableThreadContext`. (#1426)
* Use the module name of Conversant Media Disruptor from version
`1.2.16+` of the library.
* Fix NPE in `RollingFileManager`. (#1645)
* Fix `log4j-to-slf4j` JPMS and OSGi descriptors. (#1983)
* Workaround a Coursier/Ivy dependency resolution bug affecting
`log4j-slf4j-impl` and `log4j-mongodb3`. (#2065)
[#release-notes-2-22-1-updated]
=== Updated
* Bumped the minimum Java version required for the build to Java 17.
Runtime requirements remain unchanged. (#2021)
* Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2030)
* Update `com.google.guava:guava` to version `33.0.0-jre` (#2110)
* Update `commons-codec:commons-codec` to version `1.16.0` (#2042)
* Update `commons-io:commons-io` to version `2.15.1` (#2034)
* Update `commons-logging:commons-logging` to version `1.3.0` (#2050)
* Update `io.netty:netty-bom` to version `4.1.104.Final` (#2095)
* Update `org.apache.commons:commons-compress` to version `1.25.0` (#2045)
* Update `org.apache.commons:commons-dbcp2` to version `2.11.0` (#2048)
* Update `org.apache.commons:commons-lang3` to version `3.14.0` (#2047)
* Update `org.apache.commons:commons-pool2` to version `2.12.0` (#2057)
* Update `org.apache.kafka:kafka-clients` to version `3.6.1` (#2068)
* Update `org.apache.logging:logging-parent` to version `10.5.0` (#2119)
* Update `org.jctools:jctools-core` to version `4.0.2` (#1984)
* Update `org.springframework.boot:spring-boot` to version `2.7.18` (#1998)
* Update `org.springframework.cloud:spring-cloud-dependencies` to
version `2021.0.9` (#2109)
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
On Wed, 27 Dec 2023 at 00:54, Matt Sicker <ma...@musigma.org> wrote:
>
> While there appears to be some issues with the reproducibility of the build, it appears to be inconsequential.
>
> +1
Adding my +1, this vote passes with 3 +1 from: Gary, Matt and me.
I will continue the release process.
Piotr
BTW: reproducibility is not an issue for me (Debian 11, JDK 17).
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by Matt Sicker <ma...@musigma.org>.
While there appears to be some issues with the reproducibility of the build, it appears to be inconsequential.
+1
—
Matt Sicker
> On Dec 22, 2023, at 12:00, Piotr P. Karwasz <pi...@gmail.com> wrote:
>
> This is a vote to release the Apache Log4j 2.22.1.
>
> Website: https://logging.staged.apache.org/log4j/2.x/
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 8469975a4f2b1f8f1bd4f25ca6d1989a52aefc1b
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1254
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review Kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> wget --recursive --no-parent --no-host-directories --cut-dirs=5
> https://dist.apache.org/repos/dist/dev/logging/log4j
>
> # Verify checksums
> sha512sum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1254
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> == Release Notes
>
> This release contains only dependency upgrades and bug fixes, which do
> not change the behavior of the artifacts.
>
> While maintaining compatibility with Java 8, the artifacts in this
> release where generated using JDK 17, unlike version `2.22.0` that
> used JDK 11.
>
>
> [#release-notes-2-22-1-fixed]
> === Fixed
>
> * Mark `JdkMapAdapterStringMap` as frozen if map is immutable. (#2098)
> * Fix NPE in `CloseableThreadContext`. (#1426)
> * Use the module name of Conversant Media Disruptor from version
> `1.2.16+` of the library.
> * Fix NPE in `RollingFileManager`. (#1645)
> * Fix `log4j-to-slf4j` JPMS and OSGi descriptors. (#1983)
> * Workaround a Coursier/Ivy dependency resolution bug affecting
> `log4j-slf4j-impl` and `log4j-mongodb3`. (#2065)
>
> [#release-notes-2-22-1-updated]
> === Updated
>
> * Bumped the minimum Java version required for the build to Java 17.
> Runtime requirements remain unchanged. (#2021)
> * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2030)
> * Update `com.google.guava:guava` to version `33.0.0-jre` (#2110)
> * Update `commons-codec:commons-codec` to version `1.16.0` (#2042)
> * Update `commons-io:commons-io` to version `2.15.1` (#2034)
> * Update `commons-logging:commons-logging` to version `1.3.0` (#2050)
> * Update `io.netty:netty-bom` to version `4.1.104.Final` (#2095)
> * Update `org.apache.commons:commons-compress` to version `1.25.0` (#2045)
> * Update `org.apache.commons:commons-dbcp2` to version `2.11.0` (#2048)
> * Update `org.apache.commons:commons-lang3` to version `3.14.0` (#2047)
> * Update `org.apache.commons:commons-pool2` to version `2.12.0` (#2057)
> * Update `org.apache.kafka:kafka-clients` to version `3.6.1` (#2068)
> * Update `org.apache.logging:logging-parent` to version `10.5.0` (#2119)
> * Update `org.jctools:jctools-core` to version `4.0.2` (#1984)
> * Update `org.springframework.boot:spring-boot` to version `2.7.18` (#1998)
> * Update `org.springframework.cloud:spring-cloud-dependencies` to
> version `2021.0.9` (#2109)
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by Gary Gregory <ga...@gmail.com>.
Hi Piotr,
I'm pretty sure there aren't any Apache requirements around tagging in git
(or svn) but it seems nice to me to have tags for release candidates. Not
that big of a deal probably.
Gary
On Sat, Dec 23, 2023, 2:51 PM Piotr P. Karwasz <pi...@gmail.com>
wrote:
> Hi Gary,
>
> On Sat, 23 Dec 2023 at 17:47, Gary Gregory <ga...@gmail.com> wrote:
> >
> > Question: Where is the git tag in these VOTE emails? I see a "Commit"
> > but no named tag.
>
> The CI does not create tags, but it works on a separate branch
> `release/x.y.z` and the commit should be the last commit of the
> branch.
> Of course providing a SHA1 is safer. Should we also add a tag?
>
> Piotr
>
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
On Sat, 23 Dec 2023 at 17:47, Gary Gregory <ga...@gmail.com> wrote:
>
> Question: Where is the git tag in these VOTE emails? I see a "Commit"
> but no named tag.
The CI does not create tags, but it works on a separate branch
`release/x.y.z` and the commit should be the last commit of the
branch.
Of course providing a SHA1 is safer. Should we also add a tag?
Piotr
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by Gary Gregory <ga...@gmail.com>.
Question: Where is the git tag in these VOTE emails? I see a "Commit"
but no named tag.
Gary
On Fri, Dec 22, 2023 at 1:01 PM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> This is a vote to release the Apache Log4j 2.22.1.
>
> Website: https://logging.staged.apache.org/log4j/2.x/
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 8469975a4f2b1f8f1bd4f25ca6d1989a52aefc1b
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1254
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review Kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> wget --recursive --no-parent --no-host-directories --cut-dirs=5
> https://dist.apache.org/repos/dist/dev/logging/log4j
>
> # Verify checksums
> sha512sum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1254
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> == Release Notes
>
> This release contains only dependency upgrades and bug fixes, which do
> not change the behavior of the artifacts.
>
> While maintaining compatibility with Java 8, the artifacts in this
> release where generated using JDK 17, unlike version `2.22.0` that
> used JDK 11.
>
>
> [#release-notes-2-22-1-fixed]
> === Fixed
>
> * Mark `JdkMapAdapterStringMap` as frozen if map is immutable. (#2098)
> * Fix NPE in `CloseableThreadContext`. (#1426)
> * Use the module name of Conversant Media Disruptor from version
> `1.2.16+` of the library.
> * Fix NPE in `RollingFileManager`. (#1645)
> * Fix `log4j-to-slf4j` JPMS and OSGi descriptors. (#1983)
> * Workaround a Coursier/Ivy dependency resolution bug affecting
> `log4j-slf4j-impl` and `log4j-mongodb3`. (#2065)
>
> [#release-notes-2-22-1-updated]
> === Updated
>
> * Bumped the minimum Java version required for the build to Java 17.
> Runtime requirements remain unchanged. (#2021)
> * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2030)
> * Update `com.google.guava:guava` to version `33.0.0-jre` (#2110)
> * Update `commons-codec:commons-codec` to version `1.16.0` (#2042)
> * Update `commons-io:commons-io` to version `2.15.1` (#2034)
> * Update `commons-logging:commons-logging` to version `1.3.0` (#2050)
> * Update `io.netty:netty-bom` to version `4.1.104.Final` (#2095)
> * Update `org.apache.commons:commons-compress` to version `1.25.0` (#2045)
> * Update `org.apache.commons:commons-dbcp2` to version `2.11.0` (#2048)
> * Update `org.apache.commons:commons-lang3` to version `3.14.0` (#2047)
> * Update `org.apache.commons:commons-pool2` to version `2.12.0` (#2057)
> * Update `org.apache.kafka:kafka-clients` to version `3.6.1` (#2068)
> * Update `org.apache.logging:logging-parent` to version `10.5.0` (#2119)
> * Update `org.jctools:jctools-core` to version `4.0.2` (#1984)
> * Update `org.springframework.boot:spring-boot` to version `2.7.18` (#1998)
> * Update `org.springframework.cloud:spring-cloud-dependencies` to
> version `2021.0.9` (#2109)
Re: Reproducibility checks
Posted by Matt Sicker <ma...@musigma.org>.
I’ve been using the reproducibility check provided in the vote email, though I haven’t been able to reproduce a build 100% so far due to some dependency-convergence issues in the Cassandra plugin (go figure, complex dependency tree there), but I’ve mentioned something about this in the vote emails.
—
Matt Sicker
> On Dec 27, 2023, at 08:10, Piotr P. Karwasz <pi...@gmail.com> wrote:
>
> Hi Gary,
>
> On Wed, 27 Dec 2023 at 13:58, Gary Gregory <ga...@gmail.com> wrote:
>> Please include whatever instructions you want folks to run in the vote
>> email to prove reproducibility. Then at least we can agree on what it
>> means to do the reproducibility check and when it passes or fails,
>> assuming it's a binary property.
>
> The steps to check reproducibility are in the vote e-mail:
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1254
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
>> A long-standing pet peeve of mine is PMC members (in many projects,
>> I'm not singling out Log4j here) that vote on a release candidate
>> without stating _what_ they did to check the viability of said
>> release.
>>
>> If this matters, it should be an Apache requirement, which it is not ATM AFAIK.
>
> I agree, there should be some minimal best practices for release
> verification. If Apache Security does not want ATM to set some
> guidelines, I wouldn't mind if Apache Commons did.
>
> BTW I cited your vote mail in this thread, mostly because you always
> describe what you are checking.
> From the votes of some PMC members it is impossible to deduce what was checked.
>
> Piotr
Re: Reproducibility checks
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
On Wed, 27 Dec 2023 at 13:58, Gary Gregory <ga...@gmail.com> wrote:
> Please include whatever instructions you want folks to run in the vote
> email to prove reproducibility. Then at least we can agree on what it
> means to do the reproducibility check and when it passes or fails,
> assuming it's a binary property.
The steps to check reproducibility are in the vote e-mail:
# Verify reproduciblity
umask 0022
unzip *-src.zip -d src
cd src
export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1254
sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> A long-standing pet peeve of mine is PMC members (in many projects,
> I'm not singling out Log4j here) that vote on a release candidate
> without stating _what_ they did to check the viability of said
> release.
>
> If this matters, it should be an Apache requirement, which it is not ATM AFAIK.
I agree, there should be some minimal best practices for release
verification. If Apache Security does not want ATM to set some
guidelines, I wouldn't mind if Apache Commons did.
BTW I cited your vote mail in this thread, mostly because you always
describe what you are checking.
From the votes of some PMC members it is impossible to deduce what was checked.
Piotr
Re: Reproducibility checks
Posted by Gary Gregory <ga...@gmail.com>.
Hi Piotr,
Please include whatever instructions you want folks to run in the vote
email to prove reproducibility. Then at least we can agree on what it
means to do the reproducibility check and when it passes or fails,
assuming it's a binary property.
A long-standing pet peeve of mine is PMC members (in many projects,
I'm not singling out Log4j here) that vote on a release candidate
without stating _what_ they did to check the viability of said
release.
If this matters, it should be an Apache requirement, which it is not ATM AFAIK.
Gary
On Wed, Dec 27, 2023 at 4:26 AM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> Hi Gary,
>
> On Sat, 23 Dec 2023 at 17:45, Gary Gregory <ga...@gmail.com> wrote:
> >
> > +1
> > - Tested src zip file
> > - ASC OK
> > - SHA512 OK
> > - `mvn clean verify` OK
> > - Using:
> > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > Java version: 17.0.9, vendor: Homebrew, runtime:
> > /usr/local/Cellar/openjdk@17/17.0.9/libexec/openjdk.jdk/Contents/Home
> > Default locale: en_US, platform encoding: UTF-8
> > OS name: "mac os x", version: "14.2.1", arch: "x86_64", family: "mac"
> > Darwin **** 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:54:10
> > PST 2023; root:xnu-10002.61.3~2/RELEASE_X86_64 x86_64
>
> Could you also add a reproducibility check in your next votes?
>
> For security reasons we can not release artifacts generated by the CI
> unless we can reproduce them locally or we know what exactly is the
> reason they can not be reproduced.
> This burden obviously falls on the Release Manager, but it would be
> nice to have independent confirmations before performing the release.
>
> After an actual release the Hervé's Reproducible Central project also
> verifies our artifacts, the results can be found here:
>
> https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/logging/log4j/log4j/README.md
>
> Additional projects (like Commons Logging) can be added with PRs like this one:
>
> https://github.com/jvm-repo-rebuild/reproducible-central/pull/134
>
> Piotr
>
> PS: I'll try to add PRs for your recent Commons releases, when I'll
> have some time.
Reproducibility checks
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
On Sat, 23 Dec 2023 at 17:45, Gary Gregory <ga...@gmail.com> wrote:
>
> +1
> - Tested src zip file
> - ASC OK
> - SHA512 OK
> - `mvn clean verify` OK
> - Using:
> Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> Java version: 17.0.9, vendor: Homebrew, runtime:
> /usr/local/Cellar/openjdk@17/17.0.9/libexec/openjdk.jdk/Contents/Home
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "14.2.1", arch: "x86_64", family: "mac"
> Darwin **** 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:54:10
> PST 2023; root:xnu-10002.61.3~2/RELEASE_X86_64 x86_64
Could you also add a reproducibility check in your next votes?
For security reasons we can not release artifacts generated by the CI
unless we can reproduce them locally or we know what exactly is the
reason they can not be reproduced.
This burden obviously falls on the Release Manager, but it would be
nice to have independent confirmations before performing the release.
After an actual release the Hervé's Reproducible Central project also
verifies our artifacts, the results can be found here:
https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/logging/log4j/log4j/README.md
Additional projects (like Commons Logging) can be added with PRs like this one:
https://github.com/jvm-repo-rebuild/reproducible-central/pull/134
Piotr
PS: I'll try to add PRs for your recent Commons releases, when I'll
have some time.
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by Gary Gregory <ga...@gmail.com>.
+1
- Tested src zip file
- ASC OK
- SHA512 OK
- `mvn clean verify` OK
- Using:
Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
Maven home: /usr/local/Cellar/maven/3.9.6/libexec
Java version: 17.0.9, vendor: Homebrew, runtime:
/usr/local/Cellar/openjdk@17/17.0.9/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "14.2.1", arch: "x86_64", family: "mac"
Darwin **** 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:54:10
PST 2023; root:xnu-10002.61.3~2/RELEASE_X86_64 x86_64
Gary
On Fri, Dec 22, 2023 at 1:01 PM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> This is a vote to release the Apache Log4j 2.22.1.
>
> Website: https://logging.staged.apache.org/log4j/2.x/
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 8469975a4f2b1f8f1bd4f25ca6d1989a52aefc1b
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1254
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review Kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> wget --recursive --no-parent --no-host-directories --cut-dirs=5
> https://dist.apache.org/repos/dist/dev/logging/log4j
>
> # Verify checksums
> sha512sum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1254
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> == Release Notes
>
> This release contains only dependency upgrades and bug fixes, which do
> not change the behavior of the artifacts.
>
> While maintaining compatibility with Java 8, the artifacts in this
> release where generated using JDK 17, unlike version `2.22.0` that
> used JDK 11.
>
>
> [#release-notes-2-22-1-fixed]
> === Fixed
>
> * Mark `JdkMapAdapterStringMap` as frozen if map is immutable. (#2098)
> * Fix NPE in `CloseableThreadContext`. (#1426)
> * Use the module name of Conversant Media Disruptor from version
> `1.2.16+` of the library.
> * Fix NPE in `RollingFileManager`. (#1645)
> * Fix `log4j-to-slf4j` JPMS and OSGi descriptors. (#1983)
> * Workaround a Coursier/Ivy dependency resolution bug affecting
> `log4j-slf4j-impl` and `log4j-mongodb3`. (#2065)
>
> [#release-notes-2-22-1-updated]
> === Updated
>
> * Bumped the minimum Java version required for the build to Java 17.
> Runtime requirements remain unchanged. (#2021)
> * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2030)
> * Update `com.google.guava:guava` to version `33.0.0-jre` (#2110)
> * Update `commons-codec:commons-codec` to version `1.16.0` (#2042)
> * Update `commons-io:commons-io` to version `2.15.1` (#2034)
> * Update `commons-logging:commons-logging` to version `1.3.0` (#2050)
> * Update `io.netty:netty-bom` to version `4.1.104.Final` (#2095)
> * Update `org.apache.commons:commons-compress` to version `1.25.0` (#2045)
> * Update `org.apache.commons:commons-dbcp2` to version `2.11.0` (#2048)
> * Update `org.apache.commons:commons-lang3` to version `3.14.0` (#2047)
> * Update `org.apache.commons:commons-pool2` to version `2.12.0` (#2057)
> * Update `org.apache.kafka:kafka-clients` to version `3.6.1` (#2068)
> * Update `org.apache.logging:logging-parent` to version `10.5.0` (#2119)
> * Update `org.jctools:jctools-core` to version `4.0.2` (#1984)
> * Update `org.springframework.boot:spring-boot` to version `2.7.18` (#1998)
> * Update `org.springframework.cloud:spring-cloud-dependencies` to
> version `2021.0.9` (#2109)
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by Gary Gregory <ga...@gmail.com>.
TY for the references.
Gary
On Sat, Dec 23, 2023 at 2:20 PM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> Hi Gary,
>
> On Sat, 23 Dec 2023 at 16:23, Gary Gregory <ga...@gmail.com> wrote:
> >
> > Can this noise be made quiet in the future please (mvn clean verify -U):
>
> This is a temporary workaround for three `cyclonedx-maven-plugin` limitations.
> We are still waiting for two fixes and a release of the plugin:
>
> https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/419
> https://github.com/CycloneDX/cyclonedx-maven-plugin/pull/428
>
> Piotr
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
On Sat, 23 Dec 2023 at 16:23, Gary Gregory <ga...@gmail.com> wrote:
>
> Can this noise be made quiet in the future please (mvn clean verify -U):
This is a temporary workaround for three `cyclonedx-maven-plugin` limitations.
We are still waiting for two fixes and a release of the plugin:
https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/419
https://github.com/CycloneDX/cyclonedx-maven-plugin/pull/428
Piotr
Re: [VOTE] Release Apache Log4j 2.22.1 RC1
Posted by Gary Gregory <ga...@gmail.com>.
Can this noise be made quiet in the future please (mvn clean verify -U):
...
[INFO] --- bsh:1.4:run (process-sbom) @ log4j-api-java9 ---
[INFO] Executing Script
[INFO] file class java.lang.Object
[INFO] script class java.lang.String
[INFO] evaluating script import java.io.*;
import java.nio.file.*;
import java.util.*;
import javax.xml.transform.*;
import javax.xml.transform.stream.*;
import org.apache.commons.codec.digest.*;
// Compute parameters
final String xslt = project.getProperties().getProperty("sbom.xslt");
final File pomFile = project.getModel().getPomFile();
final byte[] digest = new
DigestUtils(MessageDigestAlgorithms.SHA_256).digest(pomFile);
final UUID bomSerialNumber = UUID.nameUUIDFromBytes(digest);
final String vdrUrl =
Objects.requireNonNull(project.getProperties().getProperty("vdr.url"),
"vdr.url");
// Move original SBOM file
final Path basedir = project.getBasedir().toPath();
final Path destPath = basedir.resolve("target/bom.xml");
final Path sourcePath = basedir.resolve("target/bom.orig.xml");
if (!Files.isReadable(destPath)) {
System.out.println("No CycloneDX SBOM file found, skipping
transformation.");
return;
}
Files.move(destPath, sourcePath, new CopyOption[]
{StandardCopyOption.REPLACE_EXISTING});
// Apply XSLT transformation
final StreamSource xsltSource = new StreamSource(new StringReader(xslt));
final TransformerFactory factory = TransformerFactory.newInstance();
final Transformer transformer = factory.newTransformer(xsltSource);
transformer.setParameter("sbom.serialNumber", bomSerialNumber.toString());
transformer.setParameter("vdr.url", vdrUrl);
final StreamSource source = new
StreamSource(sourcePath.toUri().toASCIIString());
final StreamResult result = new
StreamResult(destPath.toUri().toASCIIString());
transformer.transform(source, result);
No CycloneDX SBOM file found, skipping transformation.
[INFO]
[INFO] >>> spotbugs:4.8.2.0:check (default-spotbugs) > :spotbugs @
log4j-api-java9 >>>
....
Gary
On Fri, Dec 22, 2023 at 1:01 PM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> This is a vote to release the Apache Log4j 2.22.1.
>
> Website: https://logging.staged.apache.org/log4j/2.x/
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 8469975a4f2b1f8f1bd4f25ca6d1989a52aefc1b
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1254
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review Kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> wget --recursive --no-parent --no-host-directories --cut-dirs=5
> https://dist.apache.org/repos/dist/dev/logging/log4j
>
> # Verify checksums
> sha512sum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1254
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> == Release Notes
>
> This release contains only dependency upgrades and bug fixes, which do
> not change the behavior of the artifacts.
>
> While maintaining compatibility with Java 8, the artifacts in this
> release where generated using JDK 17, unlike version `2.22.0` that
> used JDK 11.
>
>
> [#release-notes-2-22-1-fixed]
> === Fixed
>
> * Mark `JdkMapAdapterStringMap` as frozen if map is immutable. (#2098)
> * Fix NPE in `CloseableThreadContext`. (#1426)
> * Use the module name of Conversant Media Disruptor from version
> `1.2.16+` of the library.
> * Fix NPE in `RollingFileManager`. (#1645)
> * Fix `log4j-to-slf4j` JPMS and OSGi descriptors. (#1983)
> * Workaround a Coursier/Ivy dependency resolution bug affecting
> `log4j-slf4j-impl` and `log4j-mongodb3`. (#2065)
>
> [#release-notes-2-22-1-updated]
> === Updated
>
> * Bumped the minimum Java version required for the build to Java 17.
> Runtime requirements remain unchanged. (#2021)
> * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2030)
> * Update `com.google.guava:guava` to version `33.0.0-jre` (#2110)
> * Update `commons-codec:commons-codec` to version `1.16.0` (#2042)
> * Update `commons-io:commons-io` to version `2.15.1` (#2034)
> * Update `commons-logging:commons-logging` to version `1.3.0` (#2050)
> * Update `io.netty:netty-bom` to version `4.1.104.Final` (#2095)
> * Update `org.apache.commons:commons-compress` to version `1.25.0` (#2045)
> * Update `org.apache.commons:commons-dbcp2` to version `2.11.0` (#2048)
> * Update `org.apache.commons:commons-lang3` to version `3.14.0` (#2047)
> * Update `org.apache.commons:commons-pool2` to version `2.12.0` (#2057)
> * Update `org.apache.kafka:kafka-clients` to version `3.6.1` (#2068)
> * Update `org.apache.logging:logging-parent` to version `10.5.0` (#2119)
> * Update `org.jctools:jctools-core` to version `4.0.2` (#1984)
> * Update `org.springframework.boot:spring-boot` to version `2.7.18` (#1998)
> * Update `org.springframework.cloud:spring-cloud-dependencies` to
> version `2021.0.9` (#2109)