You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by Volkan Yazıcı <vo...@yazi.ci> on 2024/03/06 13:13:30 UTC
[VOTE] Release Apache Log4j 2.23.1
This is a vote to release the Apache Log4j 2.23.1.
Website: https://logging.staged.apache.org/log4j
GitHub: https://github.com/apache/logging-log4j2
Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1261
Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
Please download, test, and cast your votes on this mailing list.
[ ] +1, release the artifacts
[ ] -1, don't release, because...
This vote is open for 72 hours and will pass unless getting a
net negative vote count. All votes are welcome and we encourage
everyone to test the release, but only the Logging Services PMC
votes are officially counted.
== Review kit
The minimum set of steps needed to review the uploaded distribution
files in the Subversion repository can be summarized as follows:
# Check out the distribution
svn co https://dist.apache.org/repos/... && cd $_
# Verify checksums
shasum --check *.sha512
# Verify signatures
wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
for sigFile in *.asc; do gpg --verify $sigFile; done
# Verify reproduciblity
umask 0022
unzip *-src.zip -d src
cd src
export NEXUS_REPO=https://repository.apache.org/content/...
sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
# If preferred, augment `mvnw` with `-DskipTests` to speed things up
== Release notes
This release contains several small fixes and some dependency updates.
=== Changed
* Improve performance of `CloseableThreadContext#closeMap()` (#2296)
=== Fixed
* Fix handling of `LoggerContextAware` lookups (#2309)
* Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
* Fix that parameterized message formatting doesn't throw an exception
when there are insufficient number of parameters (#2343)
* Fix `StatusLogger` log level filtering when debug mode is enabled (#2337)
* Add `log4j2.StatusLogger.dateFormatZone` system property to set the
time-zone `StatusLogger` uses to format `java.time.Instant`. Without
this, formatting patterns accessing to time-zone-specific fields
(e.g., year-of-era) cause failures. (#2322)
* Fix `StatusLogger` to correctly read
`log4j2.StatusLogger.properties` resource (#2354)
* Fix stack overflow in `StatusLogger` (#2322)
=== Updated
* Update `jakarta.activation:jakarta.activation-api` to version `2.1.3` (#2335)
* Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
* Update `org.apache.commons:commons-compress` to version `1.26.0` (#2304)
* Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
* Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
* Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
* Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
[RESULT][VOTE] Release Apache Log4j 2.23.1
Posted by Volkan Yazıcı <vo...@yazi.ci>.
Adding my +1.
With that, the release passes with 3 binding +1 votes from Gary,
Piotr, and me. I will continue the release process.
On Wed, Mar 6, 2024 at 2:13 PM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> This is a vote to release the Apache Log4j 2.23.1.
>
> Website: https://logging.staged.apache.org/log4j
> GitHub: https://github.com/apache/logging-log4j2
> Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1261
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> svn co https://dist.apache.org/repos/... && cd $_
>
> # Verify checksums
> shasum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/...
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> # If preferred, augment `mvnw` with `-DskipTests` to speed things up
>
> == Release notes
>
> This release contains several small fixes and some dependency updates.
>
> === Changed
> * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
>
> === Fixed
>
> * Fix handling of `LoggerContextAware` lookups (#2309)
> * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
> * Fix that parameterized message formatting doesn't throw an exception
> when there are insufficient number of parameters (#2343)
> * Fix `StatusLogger` log level filtering when debug mode is enabled (#2337)
> * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
> time-zone `StatusLogger` uses to format `java.time.Instant`. Without
> this, formatting patterns accessing to time-zone-specific fields
> (e.g., year-of-era) cause failures. (#2322)
> * Fix `StatusLogger` to correctly read
> `log4j2.StatusLogger.properties` resource (#2354)
> * Fix stack overflow in `StatusLogger` (#2322)
>
> === Updated
>
> * Update `jakarta.activation:jakarta.activation-api` to version `2.1.3` (#2335)
> * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
> * Update `org.apache.commons:commons-compress` to version `1.26.0` (#2304)
> * Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
> * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
> * Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
> * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
Re: [VOTE] Release Apache Log4j 2.23.1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
On Wed, 6 Mar 2024 at 14:13, Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> This is a vote to release the Apache Log4j 2.23.1.
>
> Website: https://logging.staged.apache.org/log4j
> GitHub: https://github.com/apache/logging-log4j2
> Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1261
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
* the source and binary archive checksums match,
* the source and binary archive signatures match,
* the source archive compiles and passes tests,
* the generated artifacts are identical to those in the Maven repo,
* the generated artifacts are identical to those in the binary archive,
* the `log4j-samples-jlink` project works with Log4j 2.23.1.
Therefore +1: release the artifacts.
Piotr
Re: [log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by "Gary D. Gregory" <gg...@apache.org>.
And thank you Volkan for walking me through fixing my local issue.
Gary
On 2024/03/06 16:22:50 Gary Gregory wrote:
> The build was completed successfully.
>
> Gary
>
> On Wed, Mar 6, 2024 at 11:02 AM Gary Gregory <ga...@gmail.com> wrote:
> >
> > I nuked the whole thing (rm -rf ~/.m2/repository/) for good measure
> > (I'll do that once a month from now on).
> >
> > Building (and downloading the world)...
> >
> > It's made it past log4j-bom so we might be looking good...
> >
> > TY!
> > Gary
> >
> > On Wed, Mar 6, 2024 at 10:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > >
> > > Could you do `rm -rf ~/.m2/repository/org/apache/commons` and retry,
> > > please? (If you compare `target/bom.xml`s you can see that your local
> > > `commons-*` clones have different hashes.)
> > >
> > > On Wed, Mar 6, 2024 at 4:00 PM Gary Gregory <ga...@gmail.com> wrote:
> > >
> > > > On Wed, Mar 6, 2024 at 9:54 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > > >
> > > > > Could you share the `target/bom.xml` and
> > > >
> > > > https://paste.apache.org/za0k3
> > > >
> > > > > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> > > >
> > > > https://paste.apache.org/1403q
> > > >
> > > > Gary
> > > >
> > > > >
> > > > > On Wed, Mar 6, 2024 at 3:35 PM Gary Gregory <ga...@gmail.com>
> > > > wrote:
> > > > >
> > > > > > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > > > > export NEXUS_REPO=
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > > > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> > > > > >
> > > > > > Gary
> > > > > >
> > > > > > On Wed, Mar 6, 2024 at 9:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > > > > >
> > > > > > > Which command are you exactly running?
> > > > > > >
> > > > > > > Could you share the `target/bom.xml` and
> > > > > > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> > > > > > >
> > > > > > > On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com>
> > > > > > wrote:
> > > > > > >>
> > > > > > >> Same :-(
> > > > > > >>
> > > > > > >> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @
> > > > log4j-bom
> > > > > > ---
> > > > > > >> [INFO] skip project with packaging=pom
> > > > > > >> [INFO]
> > > > > > >> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > > > > >> [ERROR] project.build.outputTimestamp property should not be
> > > > inherited
> > > > > > >> but defined in POM
> > > > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > > > > >> Downloading from reference:
> > > > > > >>
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > > > > >> [INFO] Reference buildinfo file not found: it will be generated from
> > > > > > >> downloaded reference artifacts
> > > > > > >> Downloading from reference:
> > > > > > >>
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > > >> Downloaded from reference:
> > > > > > >>
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > > >> (12 kB at 77 kB/s)
> > > > > > >> Downloading from reference:
> > > > > > >>
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > > >> Downloaded from reference:
> > > > > > >>
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > > >> (704 kB at 914 kB/s)
> > > > > > >> [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > > > > >>
> > > > > >
> > > > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > > > > >> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > > > > > >> with diffoscope
> > > > > > >>
> > > > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > > > > >> target/bom.xml
> > > > > > >> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > > > > > >> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > > > > >> target/log4j-bom-2.23.1.buildinfo
> > > > > > >> [ERROR] see also
> > > > > > >> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > > > > >> [INFO] Reproducible Build output comparison saved to
> > > > > > >>
> > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > > >> [INFO] Aggregate buildcompare copied to
> > > > > > >>
> > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > > >> [INFO]
> > > > > >
> > > > ------------------------------------------------------------------------
> > > > > > >> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > > > > >> [INFO]
> > > > > > >> [INFO] Apache Log4j BOM ................................... FAILURE
> > > > [
> > > > > > 38.689 s]
> > > > > > >> [INFO] Apache Log4j Parent ................................ SKIPPED
> > > > > > >>
> > > > > > >> Gary
> > > > > > >>
> > > > > > >> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci>
> > > > wrote:
> > > > > > >> >
> > > > > > >> > Could you retry after cleaning up your local repository, please?
> > > > That
> > > > > > is,
> > > > > > >> >
> > > > > > >> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > > > > >> >
> > > > > > >> >
> > > > > > >> >
> > > > > > >> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <
> > > > garydgregory@gmail.com>
> > > > > > wrote:
> > > > > > >> >
> > > > > > >> > > I get a build failure:
> > > > > > >> > >
> > > > > > >> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > > > > >> > > [ERROR] project.build.outputTimestamp property should not be
> > > > > > inherited
> > > > > > >> > > but defined in POM
> > > > > > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > > > > >> > > Downloading from reference:
> > > > > > >> > >
> > > > > > >> > >
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > > > > >> > > [INFO] Reference buildinfo file not found: it will be generated
> > > > from
> > > > > > >> > > downloaded reference artifacts
> > > > > > >> > > Downloading from reference:
> > > > > > >> > >
> > > > > > >> > >
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > > >> > > Downloaded from reference:
> > > > > > >> > >
> > > > > > >> > >
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > > >> > > (12 kB at 86 kB/s)
> > > > > > >> > > Downloading from reference:
> > > > > > >> > >
> > > > > > >> > >
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > > >> > > Downloaded from reference:
> > > > > > >> > >
> > > > > > >> > >
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > > >> > > (704 kB at 949 kB/s)
> > > > > > >> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > > > > >> > >
> > > > > > >> > >
> > > > > >
> > > > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > > > > >> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml:
> > > > investigate
> > > > > > >> > > with diffoscope
> > > > > > >> > >
> > > > > >
> > > > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > > > > >> > > target/bom.xml
> > > > > > >> > > [ERROR] Reproducible Build output summary: 1 files ok, 1
> > > > different
> > > > > > >> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > > > > >> > > target/log4j-bom-2.23.1.buildinfo
> > > > > > >> > > [ERROR] see also
> > > > > > >> > >
> > > > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > > > > >> > > [INFO] Reproducible Build output comparison saved to
> > > > > > >> > >
> > > > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > > >> > > [INFO] Aggregate buildcompare copied to
> > > > > > >> > >
> > > > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > > >> > > [INFO]
> > > > > > >> > >
> > > > > >
> > > > ------------------------------------------------------------------------
> > > > > > >> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > > > > >> > > [INFO]
> > > > > > >> > > [INFO] Apache Log4j BOM ...................................
> > > > FAILURE
> > > > > > [
> > > > > > >> > > 37.006 s]
> > > > > > >> > > [INFO] Apache Log4j Parent ................................
> > > > SKIPPED
> > > > > > >> > > <snip>
> > > > > > >> > >
> > > > > > >> > > Running:
> > > > > > >> > > sh mvnw -Prelease verify artifact:compare
> > > > > > -Dreference.repo=$NEXUS_REPO
> > > > > > >> > >
> > > > > > >> > > where NEXUS_REPO is
> > > > > > >> > >
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > > > >> > >
> > > > > > >> > > Using:
> > > > > > >> > >
> > > > > > >> > > openjdk version "17.0.10" 2024-01-16
> > > > > > >> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > > > > > >> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode,
> > > > > > sharing)
> > > > > > >> > >
> > > > > > >> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > > > > > >> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > > > > > >> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> > > > > > >> > > /usr/local/Cellar/openjdk@17
> > > > > > /17.0.10/libexec/openjdk.jdk/Contents/Home
> > > > > > >> > > Default locale: en_US, platform encoding: UTF-8
> > > > > > >> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family:
> > > > > > "mac"
> > > > > > >> > >
> > > > > > >> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20
> > > > 21:28:58
> > > > > > >> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> > > > > > >> > >
> > > > > > >> > > Gary
> > > > > > >> > >
> > > > > > >> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci>
> > > > > > wrote:
> > > > > > >> > > >
> > > > > > >> > > > This is a vote to release the Apache Log4j 2.23.1.
> > > > > > >> > > >
> > > > > > >> > > > Website: https://logging.staged.apache.org/log4j
> > > > > > >> > > > GitHub: https://github.com/apache/logging-log4j2
> > > > > > >> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > > > > > >> > > > Distribution:
> > > > > > https://dist.apache.org/repos/dist/dev/logging/log4j
> > > > > > >> > > > Nexus:
> > > > > > >> > >
> > > > > >
> > > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > > > >> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > > > > > >> > > >
> > > > > > >> > > > Please download, test, and cast your votes on this mailing
> > > > list.
> > > > > > >> > > >
> > > > > > >> > > > [ ] +1, release the artifacts
> > > > > > >> > > > [ ] -1, don't release, because...
> > > > > > >> > > >
> > > > > > >> > > > This vote is open for 72 hours and will pass unless getting a
> > > > > > >> > > > net negative vote count. All votes are welcome and we
> > > > encourage
> > > > > > >> > > > everyone to test the release, but only the Logging Services
> > > > PMC
> > > > > > >> > > > votes are officially counted.
> > > > > > >> > > >
> > > > > > >> > > > == Review kit
> > > > > > >> > > >
> > > > > > >> > > > The minimum set of steps needed to review the uploaded
> > > > > > distribution
> > > > > > >> > > > files in the Subversion repository can be summarized as
> > > > follows:
> > > > > > >> > > >
> > > > > > >> > > > # Check out the distribution
> > > > > > >> > > > svn co https://dist.apache.org/repos/... && cd $_
> > > > > > >> > > >
> > > > > > >> > > > # Verify checksums
> > > > > > >> > > > shasum --check *.sha512
> > > > > > >> > > >
> > > > > > >> > > > # Verify signatures
> > > > > > >> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg
> > > > > > --import
> > > > > > >> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > > > > > >> > > >
> > > > > > >> > > > # Verify reproduciblity
> > > > > > >> > > > umask 0022
> > > > > > >> > > > unzip *-src.zip -d src
> > > > > > >> > > > cd src
> > > > > > >> > > > export NEXUS_REPO=https://repository.apache.org/content/.
> > > > ..
> > > > > > >> > > > sh mvnw -Prelease verify artifact:compare
> > > > > > >> > > -Dreference.repo=$NEXUS_REPO
> > > > > > >> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed
> > > > > > things up
> > > > > > >> > > >
> > > > > > >> > > > == Release notes
> > > > > > >> > > >
> > > > > > >> > > > This release contains several small fixes and some dependency
> > > > > > updates.
> > > > > > >> > > >
> > > > > > >> > > > === Changed
> > > > > > >> > > > * Improve performance of `CloseableThreadContext#closeMap()`
> > > > > > (#2296)
> > > > > > >> > > >
> > > > > > >> > > > === Fixed
> > > > > > >> > > >
> > > > > > >> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > > > > > >> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern
> > > > > > (#2346)
> > > > > > >> > > > * Fix that parameterized message formatting doesn't throw an
> > > > > > exception
> > > > > > >> > > > when there are insufficient number of parameters (#2343)
> > > > > > >> > > > * Fix `StatusLogger` log level filtering when debug mode is
> > > > > > enabled
> > > > > > >> > > (#2337)
> > > > > > >> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to
> > > > set
> > > > > > the
> > > > > > >> > > > time-zone `StatusLogger` uses to format `java.time.Instant`.
> > > > > > Without
> > > > > > >> > > > this, formatting patterns accessing to time-zone-specific
> > > > fields
> > > > > > >> > > > (e.g., year-of-era) cause failures. (#2322)
> > > > > > >> > > > * Fix `StatusLogger` to correctly read
> > > > > > >> > > > `log4j2.StatusLogger.properties` resource (#2354)
> > > > > > >> > > > * Fix stack overflow in `StatusLogger` (#2322)
> > > > > > >> > > >
> > > > > > >> > > > === Updated
> > > > > > >> > > >
> > > > > > >> > > > * Update `jakarta.activation:jakarta.activation-api` to
> > > > version
> > > > > > `2.1.3`
> > > > > > >> > > (#2335)
> > > > > > >> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3`
> > > > > > (#2348)
> > > > > > >> > > > * Update `org.apache.commons:commons-compress` to version
> > > > `1.26.0`
> > > > > > >> > > (#2304)
> > > > > > >> > > > * Update `org.apache.commons:commons-dbcp2` to version
> > > > `2.12.0`
> > > > > > (#2344)
> > > > > > >> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0`
> > > > > > (#2326)
> > > > > > >> > > > * Update `org.eclipse.angus:angus-activation` to version
> > > > `2.0.2`
> > > > > > (#2336)
> > > > > > >> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3`
> > > > > > (#2349)
> > > > > > >> > >
> > > > > >
> > > >
>
Re: [log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by Gary Gregory <ga...@gmail.com>.
The build was completed successfully.
Gary
On Wed, Mar 6, 2024 at 11:02 AM Gary Gregory <ga...@gmail.com> wrote:
>
> I nuked the whole thing (rm -rf ~/.m2/repository/) for good measure
> (I'll do that once a month from now on).
>
> Building (and downloading the world)...
>
> It's made it past log4j-bom so we might be looking good...
>
> TY!
> Gary
>
> On Wed, Mar 6, 2024 at 10:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> >
> > Could you do `rm -rf ~/.m2/repository/org/apache/commons` and retry,
> > please? (If you compare `target/bom.xml`s you can see that your local
> > `commons-*` clones have different hashes.)
> >
> > On Wed, Mar 6, 2024 at 4:00 PM Gary Gregory <ga...@gmail.com> wrote:
> >
> > > On Wed, Mar 6, 2024 at 9:54 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > >
> > > > Could you share the `target/bom.xml` and
> > >
> > > https://paste.apache.org/za0k3
> > >
> > > > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> > >
> > > https://paste.apache.org/1403q
> > >
> > > Gary
> > >
> > > >
> > > > On Wed, Mar 6, 2024 at 3:35 PM Gary Gregory <ga...@gmail.com>
> > > wrote:
> > > >
> > > > > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > > > export NEXUS_REPO=
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> > > > >
> > > > > Gary
> > > > >
> > > > > On Wed, Mar 6, 2024 at 9:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > > > >
> > > > > > Which command are you exactly running?
> > > > > >
> > > > > > Could you share the `target/bom.xml` and
> > > > > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> > > > > >
> > > > > > On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com>
> > > > > wrote:
> > > > > >>
> > > > > >> Same :-(
> > > > > >>
> > > > > >> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @
> > > log4j-bom
> > > > > ---
> > > > > >> [INFO] skip project with packaging=pom
> > > > > >> [INFO]
> > > > > >> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > > > >> [ERROR] project.build.outputTimestamp property should not be
> > > inherited
> > > > > >> but defined in POM
> > > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > > > >> Downloading from reference:
> > > > > >>
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > > > >> [INFO] Reference buildinfo file not found: it will be generated from
> > > > > >> downloaded reference artifacts
> > > > > >> Downloading from reference:
> > > > > >>
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > >> Downloaded from reference:
> > > > > >>
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > >> (12 kB at 77 kB/s)
> > > > > >> Downloading from reference:
> > > > > >>
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > >> Downloaded from reference:
> > > > > >>
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > >> (704 kB at 914 kB/s)
> > > > > >> [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > > > >>
> > > > >
> > > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > > > >> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > > > > >> with diffoscope
> > > > > >>
> > > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > > > >> target/bom.xml
> > > > > >> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > > > > >> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > > > >> target/log4j-bom-2.23.1.buildinfo
> > > > > >> [ERROR] see also
> > > > > >> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > > > >> [INFO] Reproducible Build output comparison saved to
> > > > > >>
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > >> [INFO] Aggregate buildcompare copied to
> > > > > >>
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > >> [INFO]
> > > > >
> > > ------------------------------------------------------------------------
> > > > > >> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > > > >> [INFO]
> > > > > >> [INFO] Apache Log4j BOM ................................... FAILURE
> > > [
> > > > > 38.689 s]
> > > > > >> [INFO] Apache Log4j Parent ................................ SKIPPED
> > > > > >>
> > > > > >> Gary
> > > > > >>
> > > > > >> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci>
> > > wrote:
> > > > > >> >
> > > > > >> > Could you retry after cleaning up your local repository, please?
> > > That
> > > > > is,
> > > > > >> >
> > > > > >> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > > > >> >
> > > > > >> >
> > > > > >> >
> > > > > >> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <
> > > garydgregory@gmail.com>
> > > > > wrote:
> > > > > >> >
> > > > > >> > > I get a build failure:
> > > > > >> > >
> > > > > >> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > > > >> > > [ERROR] project.build.outputTimestamp property should not be
> > > > > inherited
> > > > > >> > > but defined in POM
> > > > > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > > > >> > > Downloading from reference:
> > > > > >> > >
> > > > > >> > >
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > > > >> > > [INFO] Reference buildinfo file not found: it will be generated
> > > from
> > > > > >> > > downloaded reference artifacts
> > > > > >> > > Downloading from reference:
> > > > > >> > >
> > > > > >> > >
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > >> > > Downloaded from reference:
> > > > > >> > >
> > > > > >> > >
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > > >> > > (12 kB at 86 kB/s)
> > > > > >> > > Downloading from reference:
> > > > > >> > >
> > > > > >> > >
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > >> > > Downloaded from reference:
> > > > > >> > >
> > > > > >> > >
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > > >> > > (704 kB at 949 kB/s)
> > > > > >> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > > > >> > >
> > > > > >> > >
> > > > >
> > > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > > > >> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml:
> > > investigate
> > > > > >> > > with diffoscope
> > > > > >> > >
> > > > >
> > > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > > > >> > > target/bom.xml
> > > > > >> > > [ERROR] Reproducible Build output summary: 1 files ok, 1
> > > different
> > > > > >> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > > > >> > > target/log4j-bom-2.23.1.buildinfo
> > > > > >> > > [ERROR] see also
> > > > > >> > >
> > > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > > > >> > > [INFO] Reproducible Build output comparison saved to
> > > > > >> > >
> > > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > >> > > [INFO] Aggregate buildcompare copied to
> > > > > >> > >
> > > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > > >> > > [INFO]
> > > > > >> > >
> > > > >
> > > ------------------------------------------------------------------------
> > > > > >> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > > > >> > > [INFO]
> > > > > >> > > [INFO] Apache Log4j BOM ...................................
> > > FAILURE
> > > > > [
> > > > > >> > > 37.006 s]
> > > > > >> > > [INFO] Apache Log4j Parent ................................
> > > SKIPPED
> > > > > >> > > <snip>
> > > > > >> > >
> > > > > >> > > Running:
> > > > > >> > > sh mvnw -Prelease verify artifact:compare
> > > > > -Dreference.repo=$NEXUS_REPO
> > > > > >> > >
> > > > > >> > > where NEXUS_REPO is
> > > > > >> > >
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > > >> > >
> > > > > >> > > Using:
> > > > > >> > >
> > > > > >> > > openjdk version "17.0.10" 2024-01-16
> > > > > >> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > > > > >> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode,
> > > > > sharing)
> > > > > >> > >
> > > > > >> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > > > > >> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > > > > >> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> > > > > >> > > /usr/local/Cellar/openjdk@17
> > > > > /17.0.10/libexec/openjdk.jdk/Contents/Home
> > > > > >> > > Default locale: en_US, platform encoding: UTF-8
> > > > > >> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family:
> > > > > "mac"
> > > > > >> > >
> > > > > >> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20
> > > 21:28:58
> > > > > >> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> > > > > >> > >
> > > > > >> > > Gary
> > > > > >> > >
> > > > > >> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci>
> > > > > wrote:
> > > > > >> > > >
> > > > > >> > > > This is a vote to release the Apache Log4j 2.23.1.
> > > > > >> > > >
> > > > > >> > > > Website: https://logging.staged.apache.org/log4j
> > > > > >> > > > GitHub: https://github.com/apache/logging-log4j2
> > > > > >> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > > > > >> > > > Distribution:
> > > > > https://dist.apache.org/repos/dist/dev/logging/log4j
> > > > > >> > > > Nexus:
> > > > > >> > >
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > > >> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > > > > >> > > >
> > > > > >> > > > Please download, test, and cast your votes on this mailing
> > > list.
> > > > > >> > > >
> > > > > >> > > > [ ] +1, release the artifacts
> > > > > >> > > > [ ] -1, don't release, because...
> > > > > >> > > >
> > > > > >> > > > This vote is open for 72 hours and will pass unless getting a
> > > > > >> > > > net negative vote count. All votes are welcome and we
> > > encourage
> > > > > >> > > > everyone to test the release, but only the Logging Services
> > > PMC
> > > > > >> > > > votes are officially counted.
> > > > > >> > > >
> > > > > >> > > > == Review kit
> > > > > >> > > >
> > > > > >> > > > The minimum set of steps needed to review the uploaded
> > > > > distribution
> > > > > >> > > > files in the Subversion repository can be summarized as
> > > follows:
> > > > > >> > > >
> > > > > >> > > > # Check out the distribution
> > > > > >> > > > svn co https://dist.apache.org/repos/... && cd $_
> > > > > >> > > >
> > > > > >> > > > # Verify checksums
> > > > > >> > > > shasum --check *.sha512
> > > > > >> > > >
> > > > > >> > > > # Verify signatures
> > > > > >> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg
> > > > > --import
> > > > > >> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > > > > >> > > >
> > > > > >> > > > # Verify reproduciblity
> > > > > >> > > > umask 0022
> > > > > >> > > > unzip *-src.zip -d src
> > > > > >> > > > cd src
> > > > > >> > > > export NEXUS_REPO=https://repository.apache.org/content/.
> > > ..
> > > > > >> > > > sh mvnw -Prelease verify artifact:compare
> > > > > >> > > -Dreference.repo=$NEXUS_REPO
> > > > > >> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed
> > > > > things up
> > > > > >> > > >
> > > > > >> > > > == Release notes
> > > > > >> > > >
> > > > > >> > > > This release contains several small fixes and some dependency
> > > > > updates.
> > > > > >> > > >
> > > > > >> > > > === Changed
> > > > > >> > > > * Improve performance of `CloseableThreadContext#closeMap()`
> > > > > (#2296)
> > > > > >> > > >
> > > > > >> > > > === Fixed
> > > > > >> > > >
> > > > > >> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > > > > >> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern
> > > > > (#2346)
> > > > > >> > > > * Fix that parameterized message formatting doesn't throw an
> > > > > exception
> > > > > >> > > > when there are insufficient number of parameters (#2343)
> > > > > >> > > > * Fix `StatusLogger` log level filtering when debug mode is
> > > > > enabled
> > > > > >> > > (#2337)
> > > > > >> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to
> > > set
> > > > > the
> > > > > >> > > > time-zone `StatusLogger` uses to format `java.time.Instant`.
> > > > > Without
> > > > > >> > > > this, formatting patterns accessing to time-zone-specific
> > > fields
> > > > > >> > > > (e.g., year-of-era) cause failures. (#2322)
> > > > > >> > > > * Fix `StatusLogger` to correctly read
> > > > > >> > > > `log4j2.StatusLogger.properties` resource (#2354)
> > > > > >> > > > * Fix stack overflow in `StatusLogger` (#2322)
> > > > > >> > > >
> > > > > >> > > > === Updated
> > > > > >> > > >
> > > > > >> > > > * Update `jakarta.activation:jakarta.activation-api` to
> > > version
> > > > > `2.1.3`
> > > > > >> > > (#2335)
> > > > > >> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3`
> > > > > (#2348)
> > > > > >> > > > * Update `org.apache.commons:commons-compress` to version
> > > `1.26.0`
> > > > > >> > > (#2304)
> > > > > >> > > > * Update `org.apache.commons:commons-dbcp2` to version
> > > `2.12.0`
> > > > > (#2344)
> > > > > >> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0`
> > > > > (#2326)
> > > > > >> > > > * Update `org.eclipse.angus:angus-activation` to version
> > > `2.0.2`
> > > > > (#2336)
> > > > > >> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3`
> > > > > (#2349)
> > > > > >> > >
> > > > >
> > >
Re: [log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by Gary Gregory <ga...@gmail.com>.
I nuked the whole thing (rm -rf ~/.m2/repository/) for good measure
(I'll do that once a month from now on).
Building (and downloading the world)...
It's made it past log4j-bom so we might be looking good...
TY!
Gary
On Wed, Mar 6, 2024 at 10:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> Could you do `rm -rf ~/.m2/repository/org/apache/commons` and retry,
> please? (If you compare `target/bom.xml`s you can see that your local
> `commons-*` clones have different hashes.)
>
> On Wed, Mar 6, 2024 at 4:00 PM Gary Gregory <ga...@gmail.com> wrote:
>
> > On Wed, Mar 6, 2024 at 9:54 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > >
> > > Could you share the `target/bom.xml` and
> >
> > https://paste.apache.org/za0k3
> >
> > > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> >
> > https://paste.apache.org/1403q
> >
> > Gary
> >
> > >
> > > On Wed, Mar 6, 2024 at 3:35 PM Gary Gregory <ga...@gmail.com>
> > wrote:
> > >
> > > > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > > export NEXUS_REPO=
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> > > >
> > > > Gary
> > > >
> > > > On Wed, Mar 6, 2024 at 9:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > > >
> > > > > Which command are you exactly running?
> > > > >
> > > > > Could you share the `target/bom.xml` and
> > > > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> > > > >
> > > > > On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com>
> > > > wrote:
> > > > >>
> > > > >> Same :-(
> > > > >>
> > > > >> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @
> > log4j-bom
> > > > ---
> > > > >> [INFO] skip project with packaging=pom
> > > > >> [INFO]
> > > > >> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > > >> [ERROR] project.build.outputTimestamp property should not be
> > inherited
> > > > >> but defined in POM
> > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > > >> Downloading from reference:
> > > > >>
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > > >> [INFO] Reference buildinfo file not found: it will be generated from
> > > > >> downloaded reference artifacts
> > > > >> Downloading from reference:
> > > > >>
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > >> Downloaded from reference:
> > > > >>
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > >> (12 kB at 77 kB/s)
> > > > >> Downloading from reference:
> > > > >>
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > >> Downloaded from reference:
> > > > >>
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > >> (704 kB at 914 kB/s)
> > > > >> [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > > >>
> > > >
> > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > > >> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > > > >> with diffoscope
> > > > >>
> > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > > >> target/bom.xml
> > > > >> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > > > >> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > > >> target/log4j-bom-2.23.1.buildinfo
> > > > >> [ERROR] see also
> > > > >> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > > >> [INFO] Reproducible Build output comparison saved to
> > > > >>
> > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > >> [INFO] Aggregate buildcompare copied to
> > > > >>
> > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > >> [INFO]
> > > >
> > ------------------------------------------------------------------------
> > > > >> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > > >> [INFO]
> > > > >> [INFO] Apache Log4j BOM ................................... FAILURE
> > [
> > > > 38.689 s]
> > > > >> [INFO] Apache Log4j Parent ................................ SKIPPED
> > > > >>
> > > > >> Gary
> > > > >>
> > > > >> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci>
> > wrote:
> > > > >> >
> > > > >> > Could you retry after cleaning up your local repository, please?
> > That
> > > > is,
> > > > >> >
> > > > >> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > > >> >
> > > > >> >
> > > > >> >
> > > > >> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <
> > garydgregory@gmail.com>
> > > > wrote:
> > > > >> >
> > > > >> > > I get a build failure:
> > > > >> > >
> > > > >> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > > >> > > [ERROR] project.build.outputTimestamp property should not be
> > > > inherited
> > > > >> > > but defined in POM
> > > > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > > >> > > Downloading from reference:
> > > > >> > >
> > > > >> > >
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > > >> > > [INFO] Reference buildinfo file not found: it will be generated
> > from
> > > > >> > > downloaded reference artifacts
> > > > >> > > Downloading from reference:
> > > > >> > >
> > > > >> > >
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > >> > > Downloaded from reference:
> > > > >> > >
> > > > >> > >
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > > >> > > (12 kB at 86 kB/s)
> > > > >> > > Downloading from reference:
> > > > >> > >
> > > > >> > >
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > >> > > Downloaded from reference:
> > > > >> > >
> > > > >> > >
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > > >> > > (704 kB at 949 kB/s)
> > > > >> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > > >> > >
> > > > >> > >
> > > >
> > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > > >> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml:
> > investigate
> > > > >> > > with diffoscope
> > > > >> > >
> > > >
> > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > > >> > > target/bom.xml
> > > > >> > > [ERROR] Reproducible Build output summary: 1 files ok, 1
> > different
> > > > >> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > > >> > > target/log4j-bom-2.23.1.buildinfo
> > > > >> > > [ERROR] see also
> > > > >> > >
> > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > > >> > > [INFO] Reproducible Build output comparison saved to
> > > > >> > >
> > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > >> > > [INFO] Aggregate buildcompare copied to
> > > > >> > >
> > > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > > >> > > [INFO]
> > > > >> > >
> > > >
> > ------------------------------------------------------------------------
> > > > >> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > > >> > > [INFO]
> > > > >> > > [INFO] Apache Log4j BOM ...................................
> > FAILURE
> > > > [
> > > > >> > > 37.006 s]
> > > > >> > > [INFO] Apache Log4j Parent ................................
> > SKIPPED
> > > > >> > > <snip>
> > > > >> > >
> > > > >> > > Running:
> > > > >> > > sh mvnw -Prelease verify artifact:compare
> > > > -Dreference.repo=$NEXUS_REPO
> > > > >> > >
> > > > >> > > where NEXUS_REPO is
> > > > >> > >
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > >> > >
> > > > >> > > Using:
> > > > >> > >
> > > > >> > > openjdk version "17.0.10" 2024-01-16
> > > > >> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > > > >> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode,
> > > > sharing)
> > > > >> > >
> > > > >> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > > > >> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > > > >> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> > > > >> > > /usr/local/Cellar/openjdk@17
> > > > /17.0.10/libexec/openjdk.jdk/Contents/Home
> > > > >> > > Default locale: en_US, platform encoding: UTF-8
> > > > >> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family:
> > > > "mac"
> > > > >> > >
> > > > >> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20
> > 21:28:58
> > > > >> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> > > > >> > >
> > > > >> > > Gary
> > > > >> > >
> > > > >> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci>
> > > > wrote:
> > > > >> > > >
> > > > >> > > > This is a vote to release the Apache Log4j 2.23.1.
> > > > >> > > >
> > > > >> > > > Website: https://logging.staged.apache.org/log4j
> > > > >> > > > GitHub: https://github.com/apache/logging-log4j2
> > > > >> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > > > >> > > > Distribution:
> > > > https://dist.apache.org/repos/dist/dev/logging/log4j
> > > > >> > > > Nexus:
> > > > >> > >
> > > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > >> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > > > >> > > >
> > > > >> > > > Please download, test, and cast your votes on this mailing
> > list.
> > > > >> > > >
> > > > >> > > > [ ] +1, release the artifacts
> > > > >> > > > [ ] -1, don't release, because...
> > > > >> > > >
> > > > >> > > > This vote is open for 72 hours and will pass unless getting a
> > > > >> > > > net negative vote count. All votes are welcome and we
> > encourage
> > > > >> > > > everyone to test the release, but only the Logging Services
> > PMC
> > > > >> > > > votes are officially counted.
> > > > >> > > >
> > > > >> > > > == Review kit
> > > > >> > > >
> > > > >> > > > The minimum set of steps needed to review the uploaded
> > > > distribution
> > > > >> > > > files in the Subversion repository can be summarized as
> > follows:
> > > > >> > > >
> > > > >> > > > # Check out the distribution
> > > > >> > > > svn co https://dist.apache.org/repos/... && cd $_
> > > > >> > > >
> > > > >> > > > # Verify checksums
> > > > >> > > > shasum --check *.sha512
> > > > >> > > >
> > > > >> > > > # Verify signatures
> > > > >> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg
> > > > --import
> > > > >> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > > > >> > > >
> > > > >> > > > # Verify reproduciblity
> > > > >> > > > umask 0022
> > > > >> > > > unzip *-src.zip -d src
> > > > >> > > > cd src
> > > > >> > > > export NEXUS_REPO=https://repository.apache.org/content/.
> > ..
> > > > >> > > > sh mvnw -Prelease verify artifact:compare
> > > > >> > > -Dreference.repo=$NEXUS_REPO
> > > > >> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed
> > > > things up
> > > > >> > > >
> > > > >> > > > == Release notes
> > > > >> > > >
> > > > >> > > > This release contains several small fixes and some dependency
> > > > updates.
> > > > >> > > >
> > > > >> > > > === Changed
> > > > >> > > > * Improve performance of `CloseableThreadContext#closeMap()`
> > > > (#2296)
> > > > >> > > >
> > > > >> > > > === Fixed
> > > > >> > > >
> > > > >> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > > > >> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern
> > > > (#2346)
> > > > >> > > > * Fix that parameterized message formatting doesn't throw an
> > > > exception
> > > > >> > > > when there are insufficient number of parameters (#2343)
> > > > >> > > > * Fix `StatusLogger` log level filtering when debug mode is
> > > > enabled
> > > > >> > > (#2337)
> > > > >> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to
> > set
> > > > the
> > > > >> > > > time-zone `StatusLogger` uses to format `java.time.Instant`.
> > > > Without
> > > > >> > > > this, formatting patterns accessing to time-zone-specific
> > fields
> > > > >> > > > (e.g., year-of-era) cause failures. (#2322)
> > > > >> > > > * Fix `StatusLogger` to correctly read
> > > > >> > > > `log4j2.StatusLogger.properties` resource (#2354)
> > > > >> > > > * Fix stack overflow in `StatusLogger` (#2322)
> > > > >> > > >
> > > > >> > > > === Updated
> > > > >> > > >
> > > > >> > > > * Update `jakarta.activation:jakarta.activation-api` to
> > version
> > > > `2.1.3`
> > > > >> > > (#2335)
> > > > >> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3`
> > > > (#2348)
> > > > >> > > > * Update `org.apache.commons:commons-compress` to version
> > `1.26.0`
> > > > >> > > (#2304)
> > > > >> > > > * Update `org.apache.commons:commons-dbcp2` to version
> > `2.12.0`
> > > > (#2344)
> > > > >> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0`
> > > > (#2326)
> > > > >> > > > * Update `org.eclipse.angus:angus-activation` to version
> > `2.0.2`
> > > > (#2336)
> > > > >> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3`
> > > > (#2349)
> > > > >> > >
> > > >
> >
Re: [log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by Volkan Yazıcı <vo...@yazi.ci>.
Could you do `rm -rf ~/.m2/repository/org/apache/commons` and retry,
please? (If you compare `target/bom.xml`s you can see that your local
`commons-*` clones have different hashes.)
On Wed, Mar 6, 2024 at 4:00 PM Gary Gregory <ga...@gmail.com> wrote:
> On Wed, Mar 6, 2024 at 9:54 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> >
> > Could you share the `target/bom.xml` and
>
> https://paste.apache.org/za0k3
>
> > `target/log4j-bom-2.23.1.buildinfo` files too, please?
>
> https://paste.apache.org/1403q
>
> Gary
>
> >
> > On Wed, Mar 6, 2024 at 3:35 PM Gary Gregory <ga...@gmail.com>
> wrote:
> >
> > > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > export NEXUS_REPO=
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> > >
> > > Gary
> > >
> > > On Wed, Mar 6, 2024 at 9:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > >
> > > > Which command are you exactly running?
> > > >
> > > > Could you share the `target/bom.xml` and
> > > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> > > >
> > > > On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com>
> > > wrote:
> > > >>
> > > >> Same :-(
> > > >>
> > > >> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @
> log4j-bom
> > > ---
> > > >> [INFO] skip project with packaging=pom
> > > >> [INFO]
> > > >> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > >> [ERROR] project.build.outputTimestamp property should not be
> inherited
> > > >> but defined in POM
> /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > >> Downloading from reference:
> > > >>
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > >> [INFO] Reference buildinfo file not found: it will be generated from
> > > >> downloaded reference artifacts
> > > >> Downloading from reference:
> > > >>
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > >> Downloaded from reference:
> > > >>
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > >> (12 kB at 77 kB/s)
> > > >> Downloading from reference:
> > > >>
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > >> Downloaded from reference:
> > > >>
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > >> (704 kB at 914 kB/s)
> > > >> [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > >>
> > >
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > >> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > > >> with diffoscope
> > > >>
> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > >> target/bom.xml
> > > >> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > > >> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > >> target/log4j-bom-2.23.1.buildinfo
> > > >> [ERROR] see also
> > > >> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > >> [INFO] Reproducible Build output comparison saved to
> > > >>
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > >> [INFO] Aggregate buildcompare copied to
> > > >>
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > >> [INFO]
> > >
> ------------------------------------------------------------------------
> > > >> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > >> [INFO]
> > > >> [INFO] Apache Log4j BOM ................................... FAILURE
> [
> > > 38.689 s]
> > > >> [INFO] Apache Log4j Parent ................................ SKIPPED
> > > >>
> > > >> Gary
> > > >>
> > > >> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci>
> wrote:
> > > >> >
> > > >> > Could you retry after cleaning up your local repository, please?
> That
> > > is,
> > > >> >
> > > >> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > > >> >
> > > >> >
> > > >> >
> > > >> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <
> garydgregory@gmail.com>
> > > wrote:
> > > >> >
> > > >> > > I get a build failure:
> > > >> > >
> > > >> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > >> > > [ERROR] project.build.outputTimestamp property should not be
> > > inherited
> > > >> > > but defined in POM
> > > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > >> > > Downloading from reference:
> > > >> > >
> > > >> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > >> > > [INFO] Reference buildinfo file not found: it will be generated
> from
> > > >> > > downloaded reference artifacts
> > > >> > > Downloading from reference:
> > > >> > >
> > > >> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > >> > > Downloaded from reference:
> > > >> > >
> > > >> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > >> > > (12 kB at 86 kB/s)
> > > >> > > Downloading from reference:
> > > >> > >
> > > >> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > >> > > Downloaded from reference:
> > > >> > >
> > > >> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > >> > > (704 kB at 949 kB/s)
> > > >> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> > > >> > >
> > > >> > >
> > >
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > >> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml:
> investigate
> > > >> > > with diffoscope
> > > >> > >
> > >
> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > >> > > target/bom.xml
> > > >> > > [ERROR] Reproducible Build output summary: 1 files ok, 1
> different
> > > >> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > >> > > target/log4j-bom-2.23.1.buildinfo
> > > >> > > [ERROR] see also
> > > >> > >
> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > >> > > [INFO] Reproducible Build output comparison saved to
> > > >> > >
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > >> > > [INFO] Aggregate buildcompare copied to
> > > >> > >
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > >> > > [INFO]
> > > >> > >
> > >
> ------------------------------------------------------------------------
> > > >> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > >> > > [INFO]
> > > >> > > [INFO] Apache Log4j BOM ...................................
> FAILURE
> > > [
> > > >> > > 37.006 s]
> > > >> > > [INFO] Apache Log4j Parent ................................
> SKIPPED
> > > >> > > <snip>
> > > >> > >
> > > >> > > Running:
> > > >> > > sh mvnw -Prelease verify artifact:compare
> > > -Dreference.repo=$NEXUS_REPO
> > > >> > >
> > > >> > > where NEXUS_REPO is
> > > >> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > >> > >
> > > >> > > Using:
> > > >> > >
> > > >> > > openjdk version "17.0.10" 2024-01-16
> > > >> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > > >> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode,
> > > sharing)
> > > >> > >
> > > >> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > > >> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > > >> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> > > >> > > /usr/local/Cellar/openjdk@17
> > > /17.0.10/libexec/openjdk.jdk/Contents/Home
> > > >> > > Default locale: en_US, platform encoding: UTF-8
> > > >> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family:
> > > "mac"
> > > >> > >
> > > >> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20
> 21:28:58
> > > >> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> > > >> > >
> > > >> > > Gary
> > > >> > >
> > > >> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci>
> > > wrote:
> > > >> > > >
> > > >> > > > This is a vote to release the Apache Log4j 2.23.1.
> > > >> > > >
> > > >> > > > Website: https://logging.staged.apache.org/log4j
> > > >> > > > GitHub: https://github.com/apache/logging-log4j2
> > > >> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > > >> > > > Distribution:
> > > https://dist.apache.org/repos/dist/dev/logging/log4j
> > > >> > > > Nexus:
> > > >> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > >> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > > >> > > >
> > > >> > > > Please download, test, and cast your votes on this mailing
> list.
> > > >> > > >
> > > >> > > > [ ] +1, release the artifacts
> > > >> > > > [ ] -1, don't release, because...
> > > >> > > >
> > > >> > > > This vote is open for 72 hours and will pass unless getting a
> > > >> > > > net negative vote count. All votes are welcome and we
> encourage
> > > >> > > > everyone to test the release, but only the Logging Services
> PMC
> > > >> > > > votes are officially counted.
> > > >> > > >
> > > >> > > > == Review kit
> > > >> > > >
> > > >> > > > The minimum set of steps needed to review the uploaded
> > > distribution
> > > >> > > > files in the Subversion repository can be summarized as
> follows:
> > > >> > > >
> > > >> > > > # Check out the distribution
> > > >> > > > svn co https://dist.apache.org/repos/... && cd $_
> > > >> > > >
> > > >> > > > # Verify checksums
> > > >> > > > shasum --check *.sha512
> > > >> > > >
> > > >> > > > # Verify signatures
> > > >> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg
> > > --import
> > > >> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > > >> > > >
> > > >> > > > # Verify reproduciblity
> > > >> > > > umask 0022
> > > >> > > > unzip *-src.zip -d src
> > > >> > > > cd src
> > > >> > > > export NEXUS_REPO=https://repository.apache.org/content/.
> ..
> > > >> > > > sh mvnw -Prelease verify artifact:compare
> > > >> > > -Dreference.repo=$NEXUS_REPO
> > > >> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed
> > > things up
> > > >> > > >
> > > >> > > > == Release notes
> > > >> > > >
> > > >> > > > This release contains several small fixes and some dependency
> > > updates.
> > > >> > > >
> > > >> > > > === Changed
> > > >> > > > * Improve performance of `CloseableThreadContext#closeMap()`
> > > (#2296)
> > > >> > > >
> > > >> > > > === Fixed
> > > >> > > >
> > > >> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > > >> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern
> > > (#2346)
> > > >> > > > * Fix that parameterized message formatting doesn't throw an
> > > exception
> > > >> > > > when there are insufficient number of parameters (#2343)
> > > >> > > > * Fix `StatusLogger` log level filtering when debug mode is
> > > enabled
> > > >> > > (#2337)
> > > >> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to
> set
> > > the
> > > >> > > > time-zone `StatusLogger` uses to format `java.time.Instant`.
> > > Without
> > > >> > > > this, formatting patterns accessing to time-zone-specific
> fields
> > > >> > > > (e.g., year-of-era) cause failures. (#2322)
> > > >> > > > * Fix `StatusLogger` to correctly read
> > > >> > > > `log4j2.StatusLogger.properties` resource (#2354)
> > > >> > > > * Fix stack overflow in `StatusLogger` (#2322)
> > > >> > > >
> > > >> > > > === Updated
> > > >> > > >
> > > >> > > > * Update `jakarta.activation:jakarta.activation-api` to
> version
> > > `2.1.3`
> > > >> > > (#2335)
> > > >> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3`
> > > (#2348)
> > > >> > > > * Update `org.apache.commons:commons-compress` to version
> `1.26.0`
> > > >> > > (#2304)
> > > >> > > > * Update `org.apache.commons:commons-dbcp2` to version
> `2.12.0`
> > > (#2344)
> > > >> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0`
> > > (#2326)
> > > >> > > > * Update `org.eclipse.angus:angus-activation` to version
> `2.0.2`
> > > (#2336)
> > > >> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3`
> > > (#2349)
> > > >> > >
> > >
>
Re: [log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by Gary Gregory <ga...@gmail.com>.
On Wed, Mar 6, 2024 at 9:54 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> Could you share the `target/bom.xml` and
https://paste.apache.org/za0k3
> `target/log4j-bom-2.23.1.buildinfo` files too, please?
https://paste.apache.org/1403q
Gary
>
> On Wed, Mar 6, 2024 at 3:35 PM Gary Gregory <ga...@gmail.com> wrote:
>
> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > export NEXUS_REPO=
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> >
> > Gary
> >
> > On Wed, Mar 6, 2024 at 9:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > >
> > > Which command are you exactly running?
> > >
> > > Could you share the `target/bom.xml` and
> > `target/log4j-bom-2.23.1.buildinfo` files too, please?
> > >
> > > On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com>
> > wrote:
> > >>
> > >> Same :-(
> > >>
> > >> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @ log4j-bom
> > ---
> > >> [INFO] skip project with packaging=pom
> > >> [INFO]
> > >> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > >> [ERROR] project.build.outputTimestamp property should not be inherited
> > >> but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > >> Downloading from reference:
> > >>
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > >> [INFO] Reference buildinfo file not found: it will be generated from
> > >> downloaded reference artifacts
> > >> Downloading from reference:
> > >>
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > >> Downloaded from reference:
> > >>
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > >> (12 kB at 77 kB/s)
> > >> Downloading from reference:
> > >>
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > >> Downloaded from reference:
> > >>
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > >> (704 kB at 914 kB/s)
> > >> [INFO] Minimal buildinfo generated from downloaded artifacts:
> > >>
> > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > >> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > >> with diffoscope
> > >> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > >> target/bom.xml
> > >> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > >> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > >> target/log4j-bom-2.23.1.buildinfo
> > >> [ERROR] see also
> > >> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > >> [INFO] Reproducible Build output comparison saved to
> > >> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > >> [INFO] Aggregate buildcompare copied to
> > >> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > >> [INFO]
> > ------------------------------------------------------------------------
> > >> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > >> [INFO]
> > >> [INFO] Apache Log4j BOM ................................... FAILURE [
> > 38.689 s]
> > >> [INFO] Apache Log4j Parent ................................ SKIPPED
> > >>
> > >> Gary
> > >>
> > >> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > >> >
> > >> > Could you retry after cleaning up your local repository, please? That
> > is,
> > >> >
> > >> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> > >> >
> > >> >
> > >> >
> > >> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <ga...@gmail.com>
> > wrote:
> > >> >
> > >> > > I get a build failure:
> > >> > >
> > >> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > >> > > [ERROR] project.build.outputTimestamp property should not be
> > inherited
> > >> > > but defined in POM
> > /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > >> > > Downloading from reference:
> > >> > >
> > >> > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > >> > > [INFO] Reference buildinfo file not found: it will be generated from
> > >> > > downloaded reference artifacts
> > >> > > Downloading from reference:
> > >> > >
> > >> > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > >> > > Downloaded from reference:
> > >> > >
> > >> > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > >> > > (12 kB at 86 kB/s)
> > >> > > Downloading from reference:
> > >> > >
> > >> > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > >> > > Downloaded from reference:
> > >> > >
> > >> > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > >> > > (704 kB at 949 kB/s)
> > >> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> > >> > >
> > >> > >
> > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > >> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > >> > > with diffoscope
> > >> > >
> > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > >> > > target/bom.xml
> > >> > > [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > >> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > >> > > target/log4j-bom-2.23.1.buildinfo
> > >> > > [ERROR] see also
> > >> > > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > >> > > [INFO] Reproducible Build output comparison saved to
> > >> > >
> > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > >> > > [INFO] Aggregate buildcompare copied to
> > >> > >
> > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > >> > > [INFO]
> > >> > >
> > ------------------------------------------------------------------------
> > >> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > >> > > [INFO]
> > >> > > [INFO] Apache Log4j BOM ................................... FAILURE
> > [
> > >> > > 37.006 s]
> > >> > > [INFO] Apache Log4j Parent ................................ SKIPPED
> > >> > > <snip>
> > >> > >
> > >> > > Running:
> > >> > > sh mvnw -Prelease verify artifact:compare
> > -Dreference.repo=$NEXUS_REPO
> > >> > >
> > >> > > where NEXUS_REPO is
> > >> > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > >> > >
> > >> > > Using:
> > >> > >
> > >> > > openjdk version "17.0.10" 2024-01-16
> > >> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > >> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode,
> > sharing)
> > >> > >
> > >> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > >> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > >> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> > >> > > /usr/local/Cellar/openjdk@17
> > /17.0.10/libexec/openjdk.jdk/Contents/Home
> > >> > > Default locale: en_US, platform encoding: UTF-8
> > >> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family:
> > "mac"
> > >> > >
> > >> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
> > >> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> > >> > >
> > >> > > Gary
> > >> > >
> > >> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci>
> > wrote:
> > >> > > >
> > >> > > > This is a vote to release the Apache Log4j 2.23.1.
> > >> > > >
> > >> > > > Website: https://logging.staged.apache.org/log4j
> > >> > > > GitHub: https://github.com/apache/logging-log4j2
> > >> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > >> > > > Distribution:
> > https://dist.apache.org/repos/dist/dev/logging/log4j
> > >> > > > Nexus:
> > >> > >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > >> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > >> > > >
> > >> > > > Please download, test, and cast your votes on this mailing list.
> > >> > > >
> > >> > > > [ ] +1, release the artifacts
> > >> > > > [ ] -1, don't release, because...
> > >> > > >
> > >> > > > This vote is open for 72 hours and will pass unless getting a
> > >> > > > net negative vote count. All votes are welcome and we encourage
> > >> > > > everyone to test the release, but only the Logging Services PMC
> > >> > > > votes are officially counted.
> > >> > > >
> > >> > > > == Review kit
> > >> > > >
> > >> > > > The minimum set of steps needed to review the uploaded
> > distribution
> > >> > > > files in the Subversion repository can be summarized as follows:
> > >> > > >
> > >> > > > # Check out the distribution
> > >> > > > svn co https://dist.apache.org/repos/... && cd $_
> > >> > > >
> > >> > > > # Verify checksums
> > >> > > > shasum --check *.sha512
> > >> > > >
> > >> > > > # Verify signatures
> > >> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg
> > --import
> > >> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > >> > > >
> > >> > > > # Verify reproduciblity
> > >> > > > umask 0022
> > >> > > > unzip *-src.zip -d src
> > >> > > > cd src
> > >> > > > export NEXUS_REPO=https://repository.apache.org/content/...
> > >> > > > sh mvnw -Prelease verify artifact:compare
> > >> > > -Dreference.repo=$NEXUS_REPO
> > >> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed
> > things up
> > >> > > >
> > >> > > > == Release notes
> > >> > > >
> > >> > > > This release contains several small fixes and some dependency
> > updates.
> > >> > > >
> > >> > > > === Changed
> > >> > > > * Improve performance of `CloseableThreadContext#closeMap()`
> > (#2296)
> > >> > > >
> > >> > > > === Fixed
> > >> > > >
> > >> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > >> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern
> > (#2346)
> > >> > > > * Fix that parameterized message formatting doesn't throw an
> > exception
> > >> > > > when there are insufficient number of parameters (#2343)
> > >> > > > * Fix `StatusLogger` log level filtering when debug mode is
> > enabled
> > >> > > (#2337)
> > >> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to set
> > the
> > >> > > > time-zone `StatusLogger` uses to format `java.time.Instant`.
> > Without
> > >> > > > this, formatting patterns accessing to time-zone-specific fields
> > >> > > > (e.g., year-of-era) cause failures. (#2322)
> > >> > > > * Fix `StatusLogger` to correctly read
> > >> > > > `log4j2.StatusLogger.properties` resource (#2354)
> > >> > > > * Fix stack overflow in `StatusLogger` (#2322)
> > >> > > >
> > >> > > > === Updated
> > >> > > >
> > >> > > > * Update `jakarta.activation:jakarta.activation-api` to version
> > `2.1.3`
> > >> > > (#2335)
> > >> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3`
> > (#2348)
> > >> > > > * Update `org.apache.commons:commons-compress` to version `1.26.0`
> > >> > > (#2304)
> > >> > > > * Update `org.apache.commons:commons-dbcp2` to version `2.12.0`
> > (#2344)
> > >> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0`
> > (#2326)
> > >> > > > * Update `org.eclipse.angus:angus-activation` to version `2.0.2`
> > (#2336)
> > >> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3`
> > (#2349)
> > >> > >
> >
Re: [log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by Volkan Yazıcı <vo...@yazi.ci>.
Could you share the `target/bom.xml` and
`target/log4j-bom-2.23.1.buildinfo` files too, please?
On Wed, Mar 6, 2024 at 3:35 PM Gary Gregory <ga...@gmail.com> wrote:
> rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> export NEXUS_REPO=
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> Gary
>
> On Wed, Mar 6, 2024 at 9:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> >
> > Which command are you exactly running?
> >
> > Could you share the `target/bom.xml` and
> `target/log4j-bom-2.23.1.buildinfo` files too, please?
> >
> > On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com>
> wrote:
> >>
> >> Same :-(
> >>
> >> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @ log4j-bom
> ---
> >> [INFO] skip project with packaging=pom
> >> [INFO]
> >> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> >> [ERROR] project.build.outputTimestamp property should not be inherited
> >> but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> >> Downloading from reference:
> >>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> >> [INFO] Reference buildinfo file not found: it will be generated from
> >> downloaded reference artifacts
> >> Downloading from reference:
> >>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> >> Downloaded from reference:
> >>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> >> (12 kB at 77 kB/s)
> >> Downloading from reference:
> >>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> >> Downloaded from reference:
> >>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> >> (704 kB at 914 kB/s)
> >> [INFO] Minimal buildinfo generated from downloaded artifacts:
> >>
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> >> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> >> with diffoscope
> >> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> >> target/bom.xml
> >> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> >> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> >> target/log4j-bom-2.23.1.buildinfo
> >> [ERROR] see also
> >> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> >> [INFO] Reproducible Build output comparison saved to
> >> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> >> [INFO] Aggregate buildcompare copied to
> >> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> >> [INFO]
> ------------------------------------------------------------------------
> >> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> >> [INFO]
> >> [INFO] Apache Log4j BOM ................................... FAILURE [
> 38.689 s]
> >> [INFO] Apache Log4j Parent ................................ SKIPPED
> >>
> >> Gary
> >>
> >> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> >> >
> >> > Could you retry after cleaning up your local repository, please? That
> is,
> >> >
> >> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> >> >
> >> >
> >> >
> >> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <ga...@gmail.com>
> wrote:
> >> >
> >> > > I get a build failure:
> >> > >
> >> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> >> > > [ERROR] project.build.outputTimestamp property should not be
> inherited
> >> > > but defined in POM
> /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> >> > > Downloading from reference:
> >> > >
> >> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> >> > > [INFO] Reference buildinfo file not found: it will be generated from
> >> > > downloaded reference artifacts
> >> > > Downloading from reference:
> >> > >
> >> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> >> > > Downloaded from reference:
> >> > >
> >> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> >> > > (12 kB at 86 kB/s)
> >> > > Downloading from reference:
> >> > >
> >> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> >> > > Downloaded from reference:
> >> > >
> >> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> >> > > (704 kB at 949 kB/s)
> >> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> >> > >
> >> > >
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> >> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> >> > > with diffoscope
> >> > >
> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> >> > > target/bom.xml
> >> > > [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> >> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> >> > > target/log4j-bom-2.23.1.buildinfo
> >> > > [ERROR] see also
> >> > > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> >> > > [INFO] Reproducible Build output comparison saved to
> >> > >
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> >> > > [INFO] Aggregate buildcompare copied to
> >> > >
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> >> > > [INFO]
> >> > >
> ------------------------------------------------------------------------
> >> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> >> > > [INFO]
> >> > > [INFO] Apache Log4j BOM ................................... FAILURE
> [
> >> > > 37.006 s]
> >> > > [INFO] Apache Log4j Parent ................................ SKIPPED
> >> > > <snip>
> >> > >
> >> > > Running:
> >> > > sh mvnw -Prelease verify artifact:compare
> -Dreference.repo=$NEXUS_REPO
> >> > >
> >> > > where NEXUS_REPO is
> >> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> >> > >
> >> > > Using:
> >> > >
> >> > > openjdk version "17.0.10" 2024-01-16
> >> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> >> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode,
> sharing)
> >> > >
> >> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> >> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> >> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> >> > > /usr/local/Cellar/openjdk@17
> /17.0.10/libexec/openjdk.jdk/Contents/Home
> >> > > Default locale: en_US, platform encoding: UTF-8
> >> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family:
> "mac"
> >> > >
> >> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
> >> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> >> > >
> >> > > Gary
> >> > >
> >> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci>
> wrote:
> >> > > >
> >> > > > This is a vote to release the Apache Log4j 2.23.1.
> >> > > >
> >> > > > Website: https://logging.staged.apache.org/log4j
> >> > > > GitHub: https://github.com/apache/logging-log4j2
> >> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> >> > > > Distribution:
> https://dist.apache.org/repos/dist/dev/logging/log4j
> >> > > > Nexus:
> >> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> >> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> >> > > >
> >> > > > Please download, test, and cast your votes on this mailing list.
> >> > > >
> >> > > > [ ] +1, release the artifacts
> >> > > > [ ] -1, don't release, because...
> >> > > >
> >> > > > This vote is open for 72 hours and will pass unless getting a
> >> > > > net negative vote count. All votes are welcome and we encourage
> >> > > > everyone to test the release, but only the Logging Services PMC
> >> > > > votes are officially counted.
> >> > > >
> >> > > > == Review kit
> >> > > >
> >> > > > The minimum set of steps needed to review the uploaded
> distribution
> >> > > > files in the Subversion repository can be summarized as follows:
> >> > > >
> >> > > > # Check out the distribution
> >> > > > svn co https://dist.apache.org/repos/... && cd $_
> >> > > >
> >> > > > # Verify checksums
> >> > > > shasum --check *.sha512
> >> > > >
> >> > > > # Verify signatures
> >> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg
> --import
> >> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> >> > > >
> >> > > > # Verify reproduciblity
> >> > > > umask 0022
> >> > > > unzip *-src.zip -d src
> >> > > > cd src
> >> > > > export NEXUS_REPO=https://repository.apache.org/content/...
> >> > > > sh mvnw -Prelease verify artifact:compare
> >> > > -Dreference.repo=$NEXUS_REPO
> >> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed
> things up
> >> > > >
> >> > > > == Release notes
> >> > > >
> >> > > > This release contains several small fixes and some dependency
> updates.
> >> > > >
> >> > > > === Changed
> >> > > > * Improve performance of `CloseableThreadContext#closeMap()`
> (#2296)
> >> > > >
> >> > > > === Fixed
> >> > > >
> >> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> >> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern
> (#2346)
> >> > > > * Fix that parameterized message formatting doesn't throw an
> exception
> >> > > > when there are insufficient number of parameters (#2343)
> >> > > > * Fix `StatusLogger` log level filtering when debug mode is
> enabled
> >> > > (#2337)
> >> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to set
> the
> >> > > > time-zone `StatusLogger` uses to format `java.time.Instant`.
> Without
> >> > > > this, formatting patterns accessing to time-zone-specific fields
> >> > > > (e.g., year-of-era) cause failures. (#2322)
> >> > > > * Fix `StatusLogger` to correctly read
> >> > > > `log4j2.StatusLogger.properties` resource (#2354)
> >> > > > * Fix stack overflow in `StatusLogger` (#2322)
> >> > > >
> >> > > > === Updated
> >> > > >
> >> > > > * Update `jakarta.activation:jakarta.activation-api` to version
> `2.1.3`
> >> > > (#2335)
> >> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3`
> (#2348)
> >> > > > * Update `org.apache.commons:commons-compress` to version `1.26.0`
> >> > > (#2304)
> >> > > > * Update `org.apache.commons:commons-dbcp2` to version `2.12.0`
> (#2344)
> >> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0`
> (#2326)
> >> > > > * Update `org.eclipse.angus:angus-activation` to version `2.0.2`
> (#2336)
> >> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3`
> (#2349)
> >> > >
>
Re: [log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by Gary Gregory <ga...@gmail.com>.
rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
export NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1261
sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
Gary
On Wed, Mar 6, 2024 at 9:33 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> Which command are you exactly running?
>
> Could you share the `target/bom.xml` and `target/log4j-bom-2.23.1.buildinfo` files too, please?
>
> On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com> wrote:
>>
>> Same :-(
>>
>> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @ log4j-bom ---
>> [INFO] skip project with packaging=pom
>> [INFO]
>> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
>> [ERROR] project.build.outputTimestamp property should not be inherited
>> but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
>> Downloading from reference:
>> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
>> [INFO] Reference buildinfo file not found: it will be generated from
>> downloaded reference artifacts
>> Downloading from reference:
>> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
>> Downloaded from reference:
>> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
>> (12 kB at 77 kB/s)
>> Downloading from reference:
>> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
>> Downloaded from reference:
>> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
>> (704 kB at 914 kB/s)
>> [INFO] Minimal buildinfo generated from downloaded artifacts:
>> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
>> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
>> with diffoscope
>> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
>> target/bom.xml
>> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
>> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
>> target/log4j-bom-2.23.1.buildinfo
>> [ERROR] see also
>> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
>> [INFO] Reproducible Build output comparison saved to
>> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
>> [INFO] Aggregate buildcompare copied to
>> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
>> [INFO] ------------------------------------------------------------------------
>> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
>> [INFO]
>> [INFO] Apache Log4j BOM ................................... FAILURE [ 38.689 s]
>> [INFO] Apache Log4j Parent ................................ SKIPPED
>>
>> Gary
>>
>> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>> >
>> > Could you retry after cleaning up your local repository, please? That is,
>> >
>> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
>> >
>> >
>> >
>> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <ga...@gmail.com> wrote:
>> >
>> > > I get a build failure:
>> > >
>> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
>> > > [ERROR] project.build.outputTimestamp property should not be inherited
>> > > but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
>> > > Downloading from reference:
>> > >
>> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
>> > > [INFO] Reference buildinfo file not found: it will be generated from
>> > > downloaded reference artifacts
>> > > Downloading from reference:
>> > >
>> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
>> > > Downloaded from reference:
>> > >
>> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
>> > > (12 kB at 86 kB/s)
>> > > Downloading from reference:
>> > >
>> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
>> > > Downloaded from reference:
>> > >
>> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
>> > > (704 kB at 949 kB/s)
>> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
>> > >
>> > > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
>> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
>> > > with diffoscope
>> > > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
>> > > target/bom.xml
>> > > [ERROR] Reproducible Build output summary: 1 files ok, 1 different
>> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
>> > > target/log4j-bom-2.23.1.buildinfo
>> > > [ERROR] see also
>> > > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
>> > > [INFO] Reproducible Build output comparison saved to
>> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
>> > > [INFO] Aggregate buildcompare copied to
>> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
>> > > [INFO]
>> > > ------------------------------------------------------------------------
>> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
>> > > [INFO]
>> > > [INFO] Apache Log4j BOM ................................... FAILURE [
>> > > 37.006 s]
>> > > [INFO] Apache Log4j Parent ................................ SKIPPED
>> > > <snip>
>> > >
>> > > Running:
>> > > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>> > >
>> > > where NEXUS_REPO is
>> > > https://repository.apache.org/content/repositories/orgapachelogging-1261
>> > >
>> > > Using:
>> > >
>> > > openjdk version "17.0.10" 2024-01-16
>> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
>> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode, sharing)
>> > >
>> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
>> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
>> > > Java version: 17.0.10, vendor: Homebrew, runtime:
>> > > /usr/local/Cellar/openjdk@17/17.0.10/libexec/openjdk.jdk/Contents/Home
>> > > Default locale: en_US, platform encoding: UTF-8
>> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family: "mac"
>> > >
>> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
>> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
>> > >
>> > > Gary
>> > >
>> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>> > > >
>> > > > This is a vote to release the Apache Log4j 2.23.1.
>> > > >
>> > > > Website: https://logging.staged.apache.org/log4j
>> > > > GitHub: https://github.com/apache/logging-log4j2
>> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
>> > > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
>> > > > Nexus:
>> > > https://repository.apache.org/content/repositories/orgapachelogging-1261
>> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>> > > >
>> > > > Please download, test, and cast your votes on this mailing list.
>> > > >
>> > > > [ ] +1, release the artifacts
>> > > > [ ] -1, don't release, because...
>> > > >
>> > > > This vote is open for 72 hours and will pass unless getting a
>> > > > net negative vote count. All votes are welcome and we encourage
>> > > > everyone to test the release, but only the Logging Services PMC
>> > > > votes are officially counted.
>> > > >
>> > > > == Review kit
>> > > >
>> > > > The minimum set of steps needed to review the uploaded distribution
>> > > > files in the Subversion repository can be summarized as follows:
>> > > >
>> > > > # Check out the distribution
>> > > > svn co https://dist.apache.org/repos/... && cd $_
>> > > >
>> > > > # Verify checksums
>> > > > shasum --check *.sha512
>> > > >
>> > > > # Verify signatures
>> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
>> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
>> > > >
>> > > > # Verify reproduciblity
>> > > > umask 0022
>> > > > unzip *-src.zip -d src
>> > > > cd src
>> > > > export NEXUS_REPO=https://repository.apache.org/content/...
>> > > > sh mvnw -Prelease verify artifact:compare
>> > > -Dreference.repo=$NEXUS_REPO
>> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed things up
>> > > >
>> > > > == Release notes
>> > > >
>> > > > This release contains several small fixes and some dependency updates.
>> > > >
>> > > > === Changed
>> > > > * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
>> > > >
>> > > > === Fixed
>> > > >
>> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
>> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
>> > > > * Fix that parameterized message formatting doesn't throw an exception
>> > > > when there are insufficient number of parameters (#2343)
>> > > > * Fix `StatusLogger` log level filtering when debug mode is enabled
>> > > (#2337)
>> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
>> > > > time-zone `StatusLogger` uses to format `java.time.Instant`. Without
>> > > > this, formatting patterns accessing to time-zone-specific fields
>> > > > (e.g., year-of-era) cause failures. (#2322)
>> > > > * Fix `StatusLogger` to correctly read
>> > > > `log4j2.StatusLogger.properties` resource (#2354)
>> > > > * Fix stack overflow in `StatusLogger` (#2322)
>> > > >
>> > > > === Updated
>> > > >
>> > > > * Update `jakarta.activation:jakarta.activation-api` to version `2.1.3`
>> > > (#2335)
>> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
>> > > > * Update `org.apache.commons:commons-compress` to version `1.26.0`
>> > > (#2304)
>> > > > * Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
>> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
>> > > > * Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
>> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
>> > >
[log4j] `2.23.1` reproducibility failure (Was: [VOTE] Release Apache Log4j 2.23.1)
Posted by Volkan Yazıcı <vo...@yazi.ci>.
Which command are you exactly running?
Could you share the `target/bom.xml` and
`target/log4j-bom-2.23.1.buildinfo` files too, please?
On Wed, Mar 6, 2024 at 3:28 PM Gary Gregory <ga...@gmail.com> wrote:
> Same :-(
>
> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @ log4j-bom ---
> [INFO] skip project with packaging=pom
> [INFO]
> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> [ERROR] project.build.outputTimestamp property should not be inherited
> but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> Downloading from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> [INFO] Reference buildinfo file not found: it will be generated from
> downloaded reference artifacts
> Downloading from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> Downloaded from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> (12 kB at 77 kB/s)
> Downloading from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> Downloaded from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> (704 kB at 914 kB/s)
> [INFO] Minimal buildinfo generated from downloaded artifacts:
>
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> with diffoscope
> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> target/bom.xml
> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> target/log4j-bom-2.23.1.buildinfo
> [ERROR] see also
> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> [INFO] Reproducible Build output comparison saved to
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> [INFO] Aggregate buildcompare copied to
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> [INFO]
> [INFO] Apache Log4j BOM ................................... FAILURE [
> 38.689 s]
> [INFO] Apache Log4j Parent ................................ SKIPPED
>
> Gary
>
> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> >
> > Could you retry after cleaning up your local repository, please? That is,
> >
> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> >
> >
> >
> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <ga...@gmail.com>
> wrote:
> >
> > > I get a build failure:
> > >
> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > [ERROR] project.build.outputTimestamp property should not be inherited
> > > but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > Downloading from reference:
> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > [INFO] Reference buildinfo file not found: it will be generated from
> > > downloaded reference artifacts
> > > Downloading from reference:
> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > Downloaded from reference:
> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > (12 kB at 86 kB/s)
> > > Downloading from reference:
> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > Downloaded from reference:
> > >
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > (704 kB at 949 kB/s)
> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> > >
> > >
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > > with diffoscope
> > >
> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > target/bom.xml
> > > [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > target/log4j-bom-2.23.1.buildinfo
> > > [ERROR] see also
> > > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > [INFO] Reproducible Build output comparison saved to
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > [INFO] Aggregate buildcompare copied to
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > [INFO]
> > >
> ------------------------------------------------------------------------
> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > [INFO]
> > > [INFO] Apache Log4j BOM ................................... FAILURE [
> > > 37.006 s]
> > > [INFO] Apache Log4j Parent ................................ SKIPPED
> > > <snip>
> > >
> > > Running:
> > > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> > >
> > > where NEXUS_REPO is
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> > >
> > > Using:
> > >
> > > openjdk version "17.0.10" 2024-01-16
> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode,
> sharing)
> > >
> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> > > /usr/local/Cellar/openjdk@17/17.0.10/libexec/openjdk.jdk/Contents/Home
> > > Default locale: en_US, platform encoding: UTF-8
> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family: "mac"
> > >
> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> > >
> > > Gary
> > >
> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > >
> > > > This is a vote to release the Apache Log4j 2.23.1.
> > > >
> > > > Website: https://logging.staged.apache.org/log4j
> > > > GitHub: https://github.com/apache/logging-log4j2
> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> > > > Nexus:
> > >
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > > >
> > > > Please download, test, and cast your votes on this mailing list.
> > > >
> > > > [ ] +1, release the artifacts
> > > > [ ] -1, don't release, because...
> > > >
> > > > This vote is open for 72 hours and will pass unless getting a
> > > > net negative vote count. All votes are welcome and we encourage
> > > > everyone to test the release, but only the Logging Services PMC
> > > > votes are officially counted.
> > > >
> > > > == Review kit
> > > >
> > > > The minimum set of steps needed to review the uploaded distribution
> > > > files in the Subversion repository can be summarized as follows:
> > > >
> > > > # Check out the distribution
> > > > svn co https://dist.apache.org/repos/... && cd $_
> > > >
> > > > # Verify checksums
> > > > shasum --check *.sha512
> > > >
> > > > # Verify signatures
> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg
> --import
> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > > >
> > > > # Verify reproduciblity
> > > > umask 0022
> > > > unzip *-src.zip -d src
> > > > cd src
> > > > export NEXUS_REPO=https://repository.apache.org/content/...
> > > > sh mvnw -Prelease verify artifact:compare
> > > -Dreference.repo=$NEXUS_REPO
> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed
> things up
> > > >
> > > > == Release notes
> > > >
> > > > This release contains several small fixes and some dependency
> updates.
> > > >
> > > > === Changed
> > > > * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
> > > >
> > > > === Fixed
> > > >
> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
> > > > * Fix that parameterized message formatting doesn't throw an
> exception
> > > > when there are insufficient number of parameters (#2343)
> > > > * Fix `StatusLogger` log level filtering when debug mode is enabled
> > > (#2337)
> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
> > > > time-zone `StatusLogger` uses to format `java.time.Instant`. Without
> > > > this, formatting patterns accessing to time-zone-specific fields
> > > > (e.g., year-of-era) cause failures. (#2322)
> > > > * Fix `StatusLogger` to correctly read
> > > > `log4j2.StatusLogger.properties` resource (#2354)
> > > > * Fix stack overflow in `StatusLogger` (#2322)
> > > >
> > > > === Updated
> > > >
> > > > * Update `jakarta.activation:jakarta.activation-api` to version
> `2.1.3`
> > > (#2335)
> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
> > > > * Update `org.apache.commons:commons-compress` to version `1.26.0`
> > > (#2304)
> > > > * Update `org.apache.commons:commons-dbcp2` to version `2.12.0`
> (#2344)
> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
> > > > * Update `org.eclipse.angus:angus-activation` to version `2.0.2`
> (#2336)
> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
> > >
>
Re: [VOTE] Release Apache Log4j 2.23.1
Posted by Gary Gregory <ga...@gmail.com>.
All better now: +1
For details see: [log4j] `2.23.1` reproducibility failure (Was: [VOTE]
Release Apache Log4j 2.23.1)
Gary
On Wed, Mar 6, 2024 at 9:26 AM Gary Gregory <ga...@gmail.com> wrote:
>
> Same :-(
>
> [INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @ log4j-bom ---
> [INFO] skip project with packaging=pom
> [INFO]
> [INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> [ERROR] project.build.outputTimestamp property should not be inherited
> but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> Downloading from reference:
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> [INFO] Reference buildinfo file not found: it will be generated from
> downloaded reference artifacts
> Downloading from reference:
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> Downloaded from reference:
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> (12 kB at 77 kB/s)
> Downloading from reference:
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> Downloaded from reference:
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> (704 kB at 914 kB/s)
> [INFO] Minimal buildinfo generated from downloaded artifacts:
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> with diffoscope
> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> target/bom.xml
> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> target/log4j-bom-2.23.1.buildinfo
> [ERROR] see also
> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> [INFO] Reproducible Build output comparison saved to
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> [INFO] Aggregate buildcompare copied to
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> [INFO] ------------------------------------------------------------------------
> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> [INFO]
> [INFO] Apache Log4j BOM ................................... FAILURE [ 38.689 s]
> [INFO] Apache Log4j Parent ................................ SKIPPED
>
> Gary
>
> On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> >
> > Could you retry after cleaning up your local repository, please? That is,
> >
> > rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
> >
> >
> >
> > On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <ga...@gmail.com> wrote:
> >
> > > I get a build failure:
> > >
> > > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > > [ERROR] project.build.outputTimestamp property should not be inherited
> > > but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > > Downloading from reference:
> > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > > [INFO] Reference buildinfo file not found: it will be generated from
> > > downloaded reference artifacts
> > > Downloading from reference:
> > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > Downloaded from reference:
> > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > > (12 kB at 86 kB/s)
> > > Downloading from reference:
> > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > Downloaded from reference:
> > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > > (704 kB at 949 kB/s)
> > > [INFO] Minimal buildinfo generated from downloaded artifacts:
> > >
> > > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > > with diffoscope
> > > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > > target/bom.xml
> > > [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > > target/log4j-bom-2.23.1.buildinfo
> > > [ERROR] see also
> > > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > > [INFO] Reproducible Build output comparison saved to
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > [INFO] Aggregate buildcompare copied to
> > > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > > [INFO]
> > > ------------------------------------------------------------------------
> > > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > > [INFO]
> > > [INFO] Apache Log4j BOM ................................... FAILURE [
> > > 37.006 s]
> > > [INFO] Apache Log4j Parent ................................ SKIPPED
> > > <snip>
> > >
> > > Running:
> > > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> > >
> > > where NEXUS_REPO is
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > >
> > > Using:
> > >
> > > openjdk version "17.0.10" 2024-01-16
> > > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode, sharing)
> > >
> > > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > > Java version: 17.0.10, vendor: Homebrew, runtime:
> > > /usr/local/Cellar/openjdk@17/17.0.10/libexec/openjdk.jdk/Contents/Home
> > > Default locale: en_US, platform encoding: UTF-8
> > > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family: "mac"
> > >
> > > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
> > > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> > >
> > > Gary
> > >
> > > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > > >
> > > > This is a vote to release the Apache Log4j 2.23.1.
> > > >
> > > > Website: https://logging.staged.apache.org/log4j
> > > > GitHub: https://github.com/apache/logging-log4j2
> > > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> > > > Nexus:
> > > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > > >
> > > > Please download, test, and cast your votes on this mailing list.
> > > >
> > > > [ ] +1, release the artifacts
> > > > [ ] -1, don't release, because...
> > > >
> > > > This vote is open for 72 hours and will pass unless getting a
> > > > net negative vote count. All votes are welcome and we encourage
> > > > everyone to test the release, but only the Logging Services PMC
> > > > votes are officially counted.
> > > >
> > > > == Review kit
> > > >
> > > > The minimum set of steps needed to review the uploaded distribution
> > > > files in the Subversion repository can be summarized as follows:
> > > >
> > > > # Check out the distribution
> > > > svn co https://dist.apache.org/repos/... && cd $_
> > > >
> > > > # Verify checksums
> > > > shasum --check *.sha512
> > > >
> > > > # Verify signatures
> > > > wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> > > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > > >
> > > > # Verify reproduciblity
> > > > umask 0022
> > > > unzip *-src.zip -d src
> > > > cd src
> > > > export NEXUS_REPO=https://repository.apache.org/content/...
> > > > sh mvnw -Prelease verify artifact:compare
> > > -Dreference.repo=$NEXUS_REPO
> > > > # If preferred, augment `mvnw` with `-DskipTests` to speed things up
> > > >
> > > > == Release notes
> > > >
> > > > This release contains several small fixes and some dependency updates.
> > > >
> > > > === Changed
> > > > * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
> > > >
> > > > === Fixed
> > > >
> > > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
> > > > * Fix that parameterized message formatting doesn't throw an exception
> > > > when there are insufficient number of parameters (#2343)
> > > > * Fix `StatusLogger` log level filtering when debug mode is enabled
> > > (#2337)
> > > > * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
> > > > time-zone `StatusLogger` uses to format `java.time.Instant`. Without
> > > > this, formatting patterns accessing to time-zone-specific fields
> > > > (e.g., year-of-era) cause failures. (#2322)
> > > > * Fix `StatusLogger` to correctly read
> > > > `log4j2.StatusLogger.properties` resource (#2354)
> > > > * Fix stack overflow in `StatusLogger` (#2322)
> > > >
> > > > === Updated
> > > >
> > > > * Update `jakarta.activation:jakarta.activation-api` to version `2.1.3`
> > > (#2335)
> > > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
> > > > * Update `org.apache.commons:commons-compress` to version `1.26.0`
> > > (#2304)
> > > > * Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
> > > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
> > > > * Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
> > > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
> > >
Re: [VOTE] Release Apache Log4j 2.23.1
Posted by Gary Gregory <ga...@gmail.com>.
Same :-(
[INFO] --- bnd-baseline:7.0.0:baseline (check-api-compat) @ log4j-bom ---
[INFO] skip project with packaging=pom
[INFO]
[INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
[ERROR] project.build.outputTimestamp property should not be inherited
but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
[INFO] Reference buildinfo file not found: it will be generated from
downloaded reference artifacts
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
Downloaded from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
(12 kB at 77 kB/s)
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
Downloaded from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
(704 kB at 914 kB/s)
[INFO] Minimal buildinfo generated from downloaded artifacts:
/Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
[ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
with diffoscope
target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
target/bom.xml
[ERROR] Reproducible Build output summary: 1 files ok, 1 different
[ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
target/log4j-bom-2.23.1.buildinfo
[ERROR] see also
https://maven.apache.org/guides/mini/guide-reproducible-builds.html
[INFO] Reproducible Build output comparison saved to
/Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
[INFO] Aggregate buildcompare copied to
/Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
[INFO]
[INFO] Apache Log4j BOM ................................... FAILURE [ 38.689 s]
[INFO] Apache Log4j Parent ................................ SKIPPED
Gary
On Wed, Mar 6, 2024 at 9:23 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> Could you retry after cleaning up your local repository, please? That is,
>
> rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
>
>
>
> On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <ga...@gmail.com> wrote:
>
> > I get a build failure:
> >
> > INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> > [ERROR] project.build.outputTimestamp property should not be inherited
> > but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> > Downloading from reference:
> >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> > [INFO] Reference buildinfo file not found: it will be generated from
> > downloaded reference artifacts
> > Downloading from reference:
> >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > Downloaded from reference:
> >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> > (12 kB at 86 kB/s)
> > Downloading from reference:
> >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > Downloaded from reference:
> >
> > https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> > (704 kB at 949 kB/s)
> > [INFO] Minimal buildinfo generated from downloaded artifacts:
> >
> > /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> > [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> > with diffoscope
> > target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> > target/bom.xml
> > [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> > [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> > target/log4j-bom-2.23.1.buildinfo
> > [ERROR] see also
> > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> > [INFO] Reproducible Build output comparison saved to
> > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > [INFO] Aggregate buildcompare copied to
> > /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> > [INFO]
> > ------------------------------------------------------------------------
> > [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> > [INFO]
> > [INFO] Apache Log4j BOM ................................... FAILURE [
> > 37.006 s]
> > [INFO] Apache Log4j Parent ................................ SKIPPED
> > <snip>
> >
> > Running:
> > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> >
> > where NEXUS_REPO is
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> >
> > Using:
> >
> > openjdk version "17.0.10" 2024-01-16
> > OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> > OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode, sharing)
> >
> > Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> > Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> > Java version: 17.0.10, vendor: Homebrew, runtime:
> > /usr/local/Cellar/openjdk@17/17.0.10/libexec/openjdk.jdk/Contents/Home
> > Default locale: en_US, platform encoding: UTF-8
> > OS name: "mac os x", version: "14.3.1", arch: "x86_64", family: "mac"
> >
> > Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
> > PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
> >
> > Gary
> >
> > On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> > >
> > > This is a vote to release the Apache Log4j 2.23.1.
> > >
> > > Website: https://logging.staged.apache.org/log4j
> > > GitHub: https://github.com/apache/logging-log4j2
> > > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> > > Nexus:
> > https://repository.apache.org/content/repositories/orgapachelogging-1261
> > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> > >
> > > Please download, test, and cast your votes on this mailing list.
> > >
> > > [ ] +1, release the artifacts
> > > [ ] -1, don't release, because...
> > >
> > > This vote is open for 72 hours and will pass unless getting a
> > > net negative vote count. All votes are welcome and we encourage
> > > everyone to test the release, but only the Logging Services PMC
> > > votes are officially counted.
> > >
> > > == Review kit
> > >
> > > The minimum set of steps needed to review the uploaded distribution
> > > files in the Subversion repository can be summarized as follows:
> > >
> > > # Check out the distribution
> > > svn co https://dist.apache.org/repos/... && cd $_
> > >
> > > # Verify checksums
> > > shasum --check *.sha512
> > >
> > > # Verify signatures
> > > wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> > > for sigFile in *.asc; do gpg --verify $sigFile; done
> > >
> > > # Verify reproduciblity
> > > umask 0022
> > > unzip *-src.zip -d src
> > > cd src
> > > export NEXUS_REPO=https://repository.apache.org/content/...
> > > sh mvnw -Prelease verify artifact:compare
> > -Dreference.repo=$NEXUS_REPO
> > > # If preferred, augment `mvnw` with `-DskipTests` to speed things up
> > >
> > > == Release notes
> > >
> > > This release contains several small fixes and some dependency updates.
> > >
> > > === Changed
> > > * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
> > >
> > > === Fixed
> > >
> > > * Fix handling of `LoggerContextAware` lookups (#2309)
> > > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
> > > * Fix that parameterized message formatting doesn't throw an exception
> > > when there are insufficient number of parameters (#2343)
> > > * Fix `StatusLogger` log level filtering when debug mode is enabled
> > (#2337)
> > > * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
> > > time-zone `StatusLogger` uses to format `java.time.Instant`. Without
> > > this, formatting patterns accessing to time-zone-specific fields
> > > (e.g., year-of-era) cause failures. (#2322)
> > > * Fix `StatusLogger` to correctly read
> > > `log4j2.StatusLogger.properties` resource (#2354)
> > > * Fix stack overflow in `StatusLogger` (#2322)
> > >
> > > === Updated
> > >
> > > * Update `jakarta.activation:jakarta.activation-api` to version `2.1.3`
> > (#2335)
> > > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
> > > * Update `org.apache.commons:commons-compress` to version `1.26.0`
> > (#2304)
> > > * Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
> > > * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
> > > * Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
> > > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
> >
Re: [VOTE] Release Apache Log4j 2.23.1
Posted by Volkan Yazıcı <vo...@yazi.ci>.
Could you retry after cleaning up your local repository, please? That is,
rm -rf ~/.m2/repository/org/apache/logging/log4j/*/2.23.1*
On Wed, Mar 6, 2024 at 3:03 PM Gary Gregory <ga...@gmail.com> wrote:
> I get a build failure:
>
> INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
> [ERROR] project.build.outputTimestamp property should not be inherited
> but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
> Downloading from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
> [INFO] Reference buildinfo file not found: it will be generated from
> downloaded reference artifacts
> Downloading from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> Downloaded from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
> (12 kB at 86 kB/s)
> Downloading from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> Downloaded from reference:
>
> https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
> (704 kB at 949 kB/s)
> [INFO] Minimal buildinfo generated from downloaded artifacts:
>
> /Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
> [ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
> with diffoscope
> target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
> target/bom.xml
> [ERROR] Reproducible Build output summary: 1 files ok, 1 different
> [ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
> target/log4j-bom-2.23.1.buildinfo
> [ERROR] see also
> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> [INFO] Reproducible Build output comparison saved to
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> [INFO] Aggregate buildcompare copied to
> /Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
> [INFO]
> ------------------------------------------------------------------------
> [INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
> [INFO]
> [INFO] Apache Log4j BOM ................................... FAILURE [
> 37.006 s]
> [INFO] Apache Log4j Parent ................................ SKIPPED
> <snip>
>
> Running:
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> where NEXUS_REPO is
> https://repository.apache.org/content/repositories/orgapachelogging-1261
>
> Using:
>
> openjdk version "17.0.10" 2024-01-16
> OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
> OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode, sharing)
>
> Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
> Maven home: /usr/local/Cellar/maven/3.9.6/libexec
> Java version: 17.0.10, vendor: Homebrew, runtime:
> /usr/local/Cellar/openjdk@17/17.0.10/libexec/openjdk.jdk/Contents/Home
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "14.3.1", arch: "x86_64", family: "mac"
>
> Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
> PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
>
> Gary
>
> On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
> >
> > This is a vote to release the Apache Log4j 2.23.1.
> >
> > Website: https://logging.staged.apache.org/log4j
> > GitHub: https://github.com/apache/logging-log4j2
> > Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> > Nexus:
> https://repository.apache.org/content/repositories/orgapachelogging-1261
> > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> >
> > Please download, test, and cast your votes on this mailing list.
> >
> > [ ] +1, release the artifacts
> > [ ] -1, don't release, because...
> >
> > This vote is open for 72 hours and will pass unless getting a
> > net negative vote count. All votes are welcome and we encourage
> > everyone to test the release, but only the Logging Services PMC
> > votes are officially counted.
> >
> > == Review kit
> >
> > The minimum set of steps needed to review the uploaded distribution
> > files in the Subversion repository can be summarized as follows:
> >
> > # Check out the distribution
> > svn co https://dist.apache.org/repos/... && cd $_
> >
> > # Verify checksums
> > shasum --check *.sha512
> >
> > # Verify signatures
> > wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> > for sigFile in *.asc; do gpg --verify $sigFile; done
> >
> > # Verify reproduciblity
> > umask 0022
> > unzip *-src.zip -d src
> > cd src
> > export NEXUS_REPO=https://repository.apache.org/content/...
> > sh mvnw -Prelease verify artifact:compare
> -Dreference.repo=$NEXUS_REPO
> > # If preferred, augment `mvnw` with `-DskipTests` to speed things up
> >
> > == Release notes
> >
> > This release contains several small fixes and some dependency updates.
> >
> > === Changed
> > * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
> >
> > === Fixed
> >
> > * Fix handling of `LoggerContextAware` lookups (#2309)
> > * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
> > * Fix that parameterized message formatting doesn't throw an exception
> > when there are insufficient number of parameters (#2343)
> > * Fix `StatusLogger` log level filtering when debug mode is enabled
> (#2337)
> > * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
> > time-zone `StatusLogger` uses to format `java.time.Instant`. Without
> > this, formatting patterns accessing to time-zone-specific fields
> > (e.g., year-of-era) cause failures. (#2322)
> > * Fix `StatusLogger` to correctly read
> > `log4j2.StatusLogger.properties` resource (#2354)
> > * Fix stack overflow in `StatusLogger` (#2322)
> >
> > === Updated
> >
> > * Update `jakarta.activation:jakarta.activation-api` to version `2.1.3`
> (#2335)
> > * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
> > * Update `org.apache.commons:commons-compress` to version `1.26.0`
> (#2304)
> > * Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
> > * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
> > * Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
> > * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
>
Re: [VOTE] Release Apache Log4j 2.23.1
Posted by Gary Gregory <ga...@gmail.com>.
I get a build failure:
INFO] --- artifact:3.5.0:compare (default-cli) @ log4j-bom ---
[ERROR] project.build.outputTimestamp property should not be inherited
but defined in POM /Users/garydgregory/rc/log4j/src/.flattened-pom.xml
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.buildinfo
[INFO] Reference buildinfo file not found: it will be generated from
downloaded reference artifacts
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
Downloaded from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1.pom
(12 kB at 86 kB/s)
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
Downloaded from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1261/org/apache/logging/log4j/log4j-bom/2.23.1/log4j-bom-2.23.1-cyclonedx.xml
(704 kB at 949 kB/s)
[INFO] Minimal buildinfo generated from downloaded artifacts:
/Users/garydgregory/rc/log4j/src/target/reference/log4j-bom-2.23.1.buildinfo
[ERROR] sha512 mismatch log4j-bom-2.23.1-cyclonedx.xml: investigate
with diffoscope
target/reference/org.apache.logging.log4j/log4j-bom-2.23.1-cyclonedx.xml
target/bom.xml
[ERROR] Reproducible Build output summary: 1 files ok, 1 different
[ERROR] see diff target/reference/log4j-bom-2.23.1.buildinfo
target/log4j-bom-2.23.1.buildinfo
[ERROR] see also
https://maven.apache.org/guides/mini/guide-reproducible-builds.html
[INFO] Reproducible Build output comparison saved to
/Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
[INFO] Aggregate buildcompare copied to
/Users/garydgregory/rc/log4j/src/target/log4j-bom-2.23.1.buildcompare
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Apache Log4j BOM 2.23.1:
[INFO]
[INFO] Apache Log4j BOM ................................... FAILURE [ 37.006 s]
[INFO] Apache Log4j Parent ................................ SKIPPED
<snip>
Running:
sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
where NEXUS_REPO is
https://repository.apache.org/content/repositories/orgapachelogging-1261
Using:
openjdk version "17.0.10" 2024-01-16
OpenJDK Runtime Environment Homebrew (build 17.0.10+0)
OpenJDK 64-Bit Server VM Homebrew (build 17.0.10+0, mixed mode, sharing)
Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
Maven home: /usr/local/Cellar/maven/3.9.6/libexec
Java version: 17.0.10, vendor: Homebrew, runtime:
/usr/local/Cellar/openjdk@17/17.0.10/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "14.3.1", arch: "x86_64", family: "mac"
Darwin **** 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58
PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64 x86_64
Gary
On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> This is a vote to release the Apache Log4j 2.23.1.
>
> Website: https://logging.staged.apache.org/log4j
> GitHub: https://github.com/apache/logging-log4j2
> Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1261
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> svn co https://dist.apache.org/repos/... && cd $_
>
> # Verify checksums
> shasum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/...
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> # If preferred, augment `mvnw` with `-DskipTests` to speed things up
>
> == Release notes
>
> This release contains several small fixes and some dependency updates.
>
> === Changed
> * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
>
> === Fixed
>
> * Fix handling of `LoggerContextAware` lookups (#2309)
> * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
> * Fix that parameterized message formatting doesn't throw an exception
> when there are insufficient number of parameters (#2343)
> * Fix `StatusLogger` log level filtering when debug mode is enabled (#2337)
> * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
> time-zone `StatusLogger` uses to format `java.time.Instant`. Without
> this, formatting patterns accessing to time-zone-specific fields
> (e.g., year-of-era) cause failures. (#2322)
> * Fix `StatusLogger` to correctly read
> `log4j2.StatusLogger.properties` resource (#2354)
> * Fix stack overflow in `StatusLogger` (#2322)
>
> === Updated
>
> * Update `jakarta.activation:jakarta.activation-api` to version `2.1.3` (#2335)
> * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
> * Update `org.apache.commons:commons-compress` to version `1.26.0` (#2304)
> * Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
> * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
> * Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
> * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)
Re: [VOTE] Release Apache Log4j 2.23.1
Posted by Gary Gregory <ga...@gmail.com>.
Hi,
Thank you for creating this RC.
It would be more helpful to provide cut-and-paste instructions. This
does not work obviously:
svn co https://dist.apache.org/repos/... && cd $_
Neither the "svn co" nor the cd "$_" will work ;-)
Gary
On Wed, Mar 6, 2024 at 8:13 AM Volkan Yazıcı <vo...@yazi.ci> wrote:
>
> This is a vote to release the Apache Log4j 2.23.1.
>
> Website: https://logging.staged.apache.org/log4j
> GitHub: https://github.com/apache/logging-log4j2
> Commit: fea2a7116160fb1555d578406444b4fc4f0ef2da
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1261
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> svn co https://dist.apache.org/repos/... && cd $_
>
> # Verify checksums
> shasum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/...
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> # If preferred, augment `mvnw` with `-DskipTests` to speed things up
>
> == Release notes
>
> This release contains several small fixes and some dependency updates.
>
> === Changed
> * Improve performance of `CloseableThreadContext#closeMap()` (#2296)
>
> === Fixed
>
> * Fix handling of `LoggerContextAware` lookups (#2309)
> * Fix NPE in `PatternProcessor` for a `UNIX_MILLIS` pattern (#2346)
> * Fix that parameterized message formatting doesn't throw an exception
> when there are insufficient number of parameters (#2343)
> * Fix `StatusLogger` log level filtering when debug mode is enabled (#2337)
> * Add `log4j2.StatusLogger.dateFormatZone` system property to set the
> time-zone `StatusLogger` uses to format `java.time.Instant`. Without
> this, formatting patterns accessing to time-zone-specific fields
> (e.g., year-of-era) cause failures. (#2322)
> * Fix `StatusLogger` to correctly read
> `log4j2.StatusLogger.properties` resource (#2354)
> * Fix stack overflow in `StatusLogger` (#2322)
>
> === Updated
>
> * Update `jakarta.activation:jakarta.activation-api` to version `2.1.3` (#2335)
> * Update `jakarta.mail:jakarta.mail-api` to version `2.1.3` (#2348)
> * Update `org.apache.commons:commons-compress` to version `1.26.0` (#2304)
> * Update `org.apache.commons:commons-dbcp2` to version `2.12.0` (#2344)
> * Update `org.apache.kafka:kafka-clients` to version `3.7.0` (#2326)
> * Update `org.eclipse.angus:angus-activation` to version `2.0.2` (#2336)
> * Update `org.eclipse.angus:jakarta.mail` to version `2.0.3` (#2349)