Hi All, Thank you Piotr for preparing the RC.
Using the review kit, this is what I get on the step 'sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO' [INFO] --- artifact:3.5.1:compare (default-cli) @ log4j-bom --- [WARNING] <project.build.outputTimestamp> property is inherited, it should be defined in pom.xml Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0.buildinfo [INFO] Reference buildinfo file not found: it will be generated from downloaded reference artifacts Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0.pom Downloaded from reference: https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0.pom (12 kB at 79 kB/s) Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0-cyclonedx.xml Downloaded from reference: https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0-cyclonedx.xml (413 kB at 595 kB/s) [INFO] Minimal buildinfo generated from downloaded artifacts: /Users/garydgregory/rc/2.24.0/src/target/reference/log4j-bom-2.24.0.buildinfo [ERROR] sha512 mismatch log4j-bom-2.24.0-cyclonedx.xml: investigate with diffoscope target/reference/org.apache.logging.log4j/log4j-bom-2.24.0-cyclonedx.xml target/bom.xml [ERROR] Reproducible Build output summary: 1 files ok, 1 different [ERROR] see diff target/reference/log4j-bom-2.24.0.buildinfo target/log4j-bom-2.24.0.buildinfo [ERROR] see also https://maven.apache.org/guides/mini/guide-reproducible-builds.html [INFO] Reproducible Build output comparison saved to /Users/garydgregory/rc/2.24.0/src/target/log4j-bom-2.24.0.buildcompare [INFO] Aggregate buildcompare copied to /Users/garydgregory/rc/2.24.0/src/target/log4j-bom-2.24.0.buildcompare [INFO] ------------------------------------------------------------------------ [INFO] Reactor Summary for Apache Log4j BOM 2.24.0: [INFO] [INFO] Apache Log4j BOM ................................... FAILURE [ 33.856 s] diff target/reference/log4j-bom-2.24.0.buildinfo target/log4j-bom-2.24.0.buildinfo says: 0a1,2 > # https://reproducible-builds.org/docs/jvm/ > buildinfo.version=1.0-SNAPSHOT 1a4,25 > name=Apache Log4j BOM > group-id=org.apache.logging.log4j > artifact-id=log4j-bom > version=2.24.0 > > # source information > source.scm.uri=scm:git:https://github.com/apache/logging-log4j2.git > source.scm.tag=2.x > > # build instructions > build-tool=mvn > > # effective build environment information > java.version=17.0.12 > java.vendor=Homebrew > os.name=Mac OS X > > # Maven rebuild instructions and effective environment > mvn.version=3.9.8 > > # output > 10c34 < outputs.1.checksums.sha512=157eb3ac9f87370a2c56afb4317433fd4733c5001e949df1278d9101fca57860f3a07c5f1665d612abc2e823d8b7c2b102dd2f779d4273b6ae177b87bd3d2760 --- > outputs.1.checksums.sha512=18b3831b831916588364e52b3f399d900c00a09d0e59cf9204c3ed5fa970428732e93cd8b417f7de725b7a57c4122227ddbeb6abb312e857250bb43d941e6214 I am using: openjdk version "17.0.12" 2024-07-16 OpenJDK Runtime Environment Homebrew (build 17.0.12+0) OpenJDK 64-Bit Server VM Homebrew (build 17.0.12+0, mixed mode, sharing) Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937) Maven home: /usr/local/Cellar/maven/3.9.9/libexec Java version: 17.0.12, vendor: Homebrew, runtime: /usr/local/Cellar/openjdk@17/17.0.12/libexec/openjdk.jdk/Contents/Home Default locale: en_US, platform encoding: UTF-8 OS name: "mac os x", version: "14.6.1", arch: "x86_64", family: "mac" Darwin .... 23.6.0 Darwin Kernel Version 23.6.0: Mon Jul 29 21:13:00 PDT 2024; root:xnu-10063.141.2~1/RELEASE_X86_64 x86_64 Gary On Sat, Aug 31, 2024 at 3:31 PM Piotr P. Karwasz <piotr.karw...@gmail.com> wrote: > > This is a vote to release the Apache Log4j `2.24.0`. > > Website: https://logging.staged.apache.org/log4j/2.24.0/index.html > GitHub: https://github.com/apache/logging-log4j2 > Commit: 08053687456f6be61ee8206da782a3d051928a57 > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j > Nexus: > https://repository.apache.org/content/repositories/orgapachelogging-1293 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... > > This vote is open for 72 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > == Review kit > > The minimum set of steps needed to review the uploaded distribution > files in the Subversion repository can be summarized as follows: > > # Check out the distribution > svn co https://dist.apache.org/repos/dist/dev/logging/log4j/2.24.0 && cd > $_ > > # Verify checksums > shasum --check *.sha512 > > # Verify signatures > wget -O - https://downloads.apache.org/logging/KEYS | gpg --import > for sigFile in *.asc; do gpg --verify $sigFile; done > > # Verify reproduciblity > umask 0022 > unzip *-src.zip -d src > cd src > export > NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1293 > sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO > # If preferred, augment `mvnw` with `-DskipTests` to speed things up > > == Release Notes > > This release contains improvements and changes in several areas of Apache > Log4j: > > === Log4j API > > The `2.24.0` version of Log4j API has been enhanced with changes from > the 3.x branch and will be used by both Log4j 2 Core and Log4j 3 Core > releases. > The changes include: > > * A faster default `ThreadContextMap`. > * Enhanced GraalVM support: native binaries that use Log4j API will no > longer require additional GraalVM configuration. > * The configuration properties subsystem now only accepts the official > pre-2.10 property names and the normalized post-2.10 names. > Check your configuration for typos. > > === Documentation > > The Apache Log4j 2 website has been almost entirely rewritten to > provide improved documentation and faster access to the information > you need. > > [1] https://logging.staged.apache.org/log4j/2.24.0/index.html > > === Bridges > > The JUL-to-Log4j API and Log4j 1-to-Log4j API will no longer be able > to modify the configuration of Log4j Core by default. > If such a functionality is required, it must be explicitly enabled. > > === Modules > > The following Log4j Core additional modules have been removed: > > `log4j-flume-ng`:: > The module has been moved to the Flume project and follows the Apache > Flume release lifecycle. > > `log4j-kubernetes`:: > The module has been moved to the > https://github.com/fabric8io/kubernetes-client/blob/main/doc/KubernetesLog4j.md[Fabric8.io > Kubernetes project] and follows the Fabric8.io release lifecycle. > > `log4j-mongodb3`:: > The module based on MongoDB Java client version 3.x has been removed. > Please migrate to `log4j-mongodb` (client version 5.x) or > `log4j-mongodb4` (client version 4.x). > > === JMX changes > > Starting in version 2.24.0, JMX support is disabled by default and can > be re-enabled via the `log4j2.disableJmx=false` system property. > > === Added > > * Add a faster `DefaultThreadContextMap` implementation. (#2330) > * Add Logback throwable-consuming semantics as an option in > `log4j-slf4j-impl` and `log4j-slf4j2-impl`. Users can enable it by > setting the property `log4j2.messageFactory` to > `org.apache.logging.slf4j.message.ThrowableConsumingMessageFactory`. > (#2363) > * Add trace context fields to `GcpLayout.json` (#2498) > * Add _"Plugin Reference"_ to the website. It is a Javadoc-on-steroids > focusing on Log4j plugins. (#1954) > * Automate website deployment using the new CI infrastructure shipped > with `org.apache.logging:logging-parent:11.0.0` > > === Changed > > * Fix usage of `log4j-api` in GraalVM without additional reachability > data. (#1539) > * Ignore exceptions thrown by PropertySources. > (https://github.com/spring-projects/spring-boot/issues/33450[Spring-33450]) > * Add logging to `PropertiesUtil` and fix `Duration` parser. (#1936) > * Disable level modification via JUL by default. (#2353) > * Centralize initialization in the `Provider` class and deprecate > `log4j2.loggerContextFactory` property. (#2374) > * Remove `log4j-kubernetes` lookup. User should migrate to > https://github.com/fabric8io/kubernetes-client/blob/main/doc/KubernetesLog4j.md[`io.fabric8:kubernetes-log4j`]. > (#2412) > * Disable JMX support by default. Require `log4j2.disableJmx` to be > set to `false` to enable JMX support. (#2462) > * Replace some usages of `DateTimeFormatter#toString()` with > `DateTimeFormatter#formatTo(StringBuilder)` to cut down on allocations > (#2515) > * Disable programmatic configuration in Log4j 1 Bridge if > `log4j1.compatibility` is `false`. (#2778) > * Improve missing plugin descriptor warnings. (#2835) > * Remove configuration properties caching and (undocumented) fuzzy > property name matching. (#2849) > * Fixes property source ordering to account for different sources with > the same priority. > (https://issues.apache.org/jira/browse/LOG4J2-3618[LOG4J2-3618]) > * Prioritize user-defined values of `log4j2.enableThreadLocals`, > `log4j2.garbagefreeThreadContextMap` and `log4j2.shutdownHookEnabled` > over the value of `log4j.isWebapp`. (#2517) > * Disallow duplicate keys in JSON Template Layout templates > * Deprecate `log4j2.defaultStatusLevel` property in Log4j Core in > favor of `log4j2.statusLoggerLevel` (#2481) > > === Deprecated > > * Deprecate `Message#getFormat()` due to unclear semantics and > inconsistent implementations (#2773) > * Deprecate `org.apache.logging.log4j.EventLogger` for removal (#2665) > * Deprecate `org.apache.logging.log4j.core.appender.rolling.action.Duration` > class for removal (#2425) > * Deprecate the `log4j-mongodb4` module in favor of `log4j-mongodb` (#2486) > > === Fixed > > * Use FQDN in RFC5424 Layout. (#1740) > * Fix custom thread-context data provider handling in lookups and > filters. (#2331) > * Fix handling of `log4j2.messageFactory` and > `log4j2.flowMessageFactory` properties (#2505) > * Discard blank keys in `PropertiesUtil` (#2414) > * Fix handling of `log4j2.debug`. (#2703) > * Fix location requirement for the `%F` and `%file` keys in Pattern > Layout (#2781) > * Fix `JsonLayout` failure under JPMS. (#2814) > * Fix empty string handling for `TruncatingBufferedWriter` (#2609) > * Fix that parameterized message formatting throws an exception when > there are insufficient number of parameters. It previously simply > didn't replace the '{}' sequence. The behavior changed in 2.21.0 and > should be restored for backward compatibility. (#2380) > * Fix `ClassCastException` in LMAX Disruptor 3 initialization (#2768) > * Fix requirement on the `java.management` module when JMX is > disabled, which is the default (#2775) > * Website is migrated to Antora with several formatting and link fixes (#2427) > > === Removed > > * Move Flume Appender to its own release lifecycle. (#2902) > > === Updated > > * Add module log4j-mongodb to track the current MongoDB driver > (currently version 5). (#2486) > * Remove module log4j-mongodb3, use log4j-mongodb instead, > log4j-mongodb4 is deprecated for removal. (#2486) > * Update `com.fasterxml.jackson:jackson-bom` to version `2.17.2` (#2719) > * Update `com.github.luben:zstd-jni` to version `1.5.6-5` (#2901) > * Update `commons-codec:commons-codec` to version `1.17.1` (#2741) > * Update `commons-logging:commons-logging` to version `1.3.4` (#2864) > * Update `github/codeql-action` to version `3.25.1` (#2483) > * Update `io.fabric8:docker-maven-plugin` to version `0.45.0` (#2776) > * Update `org.apache.cassandra:cassandra-all` to version `3.11.17` (#2479) > * Update `org.apache.commons:commons-compress` to version `1.27.1` (#2869) > * Update `org.apache.commons:commons-csv` to version `1.11.0` (#2565) > * Update `org.apache.commons:commons-lang3` to version `3.17.0` (#2907) > * Update `org.apache.kafka:kafka-clients` to version `3.8.0` (#2777) > * Update `org.apache.logging:logging-parent` to version `11.2.0` > * Update `org.eclipse.jetty:jetty-bom` to version `9.4.55.v20240627` (#2709) > * Update `org.jctools:jctools-core` to version `4.0.5` (#2637) > * Update log4j-mongodb4 `org.mongodb:*` from `4.11.1` to `4.11.2` (#2409) > * Update `org.mongodb:bson` to version `5.1.3` (#2823) > * Update `org.slf4j:slf4j-api` to version `2.0.16` (#2829) > * Update `org.springframework:spring-framework-bom` to version `5.3.39` > (#2840)
