Hi All,

Thank you Piotr for preparing the RC.

Using the review kit, this is what I get on the step 'sh mvnw
-Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO'

[INFO] --- artifact:3.5.1:compare (default-cli) @ log4j-bom ---
[WARNING] <project.build.outputTimestamp> property is inherited, it
should be defined in pom.xml
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0.buildinfo
[INFO] Reference buildinfo file not found: it will be generated from
downloaded reference artifacts
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0.pom
Downloaded from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0.pom
(12 kB at 79 kB/s)
Downloading from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0-cyclonedx.xml
Downloaded from reference:
https://repository.apache.org/content/repositories/orgapachelogging-1293/org/apache/logging/log4j/log4j-bom/2.24.0/log4j-bom-2.24.0-cyclonedx.xml
(413 kB at 595 kB/s)
[INFO] Minimal buildinfo generated from downloaded artifacts:
/Users/garydgregory/rc/2.24.0/src/target/reference/log4j-bom-2.24.0.buildinfo
[ERROR] sha512 mismatch log4j-bom-2.24.0-cyclonedx.xml: investigate
with diffoscope
target/reference/org.apache.logging.log4j/log4j-bom-2.24.0-cyclonedx.xml
target/bom.xml
[ERROR] Reproducible Build output summary: 1 files ok, 1 different
[ERROR] see diff target/reference/log4j-bom-2.24.0.buildinfo
target/log4j-bom-2.24.0.buildinfo
[ERROR] see also
https://maven.apache.org/guides/mini/guide-reproducible-builds.html
[INFO] Reproducible Build output comparison saved to
/Users/garydgregory/rc/2.24.0/src/target/log4j-bom-2.24.0.buildcompare
[INFO] Aggregate buildcompare copied to
/Users/garydgregory/rc/2.24.0/src/target/log4j-bom-2.24.0.buildcompare
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Apache Log4j BOM 2.24.0:
[INFO]
[INFO] Apache Log4j BOM ................................... FAILURE [ 33.856 s]

diff target/reference/log4j-bom-2.24.0.buildinfo
target/log4j-bom-2.24.0.buildinfo

says:

0a1,2
> # https://reproducible-builds.org/docs/jvm/
> buildinfo.version=1.0-SNAPSHOT
1a4,25
> name=Apache Log4j BOM
> group-id=org.apache.logging.log4j
> artifact-id=log4j-bom
> version=2.24.0
>
> # source information
> source.scm.uri=scm:git:https://github.com/apache/logging-log4j2.git
> source.scm.tag=2.x
>
> # build instructions
> build-tool=mvn
>
> # effective build environment information
> java.version=17.0.12
> java.vendor=Homebrew
> os.name=Mac OS X
>
> # Maven rebuild instructions and effective environment
> mvn.version=3.9.8
>
> # output
>
10c34
< 
outputs.1.checksums.sha512=157eb3ac9f87370a2c56afb4317433fd4733c5001e949df1278d9101fca57860f3a07c5f1665d612abc2e823d8b7c2b102dd2f779d4273b6ae177b87bd3d2760
---
> outputs.1.checksums.sha512=18b3831b831916588364e52b3f399d900c00a09d0e59cf9204c3ed5fa970428732e93cd8b417f7de725b7a57c4122227ddbeb6abb312e857250bb43d941e6214

I am using:

openjdk version "17.0.12" 2024-07-16
OpenJDK Runtime Environment Homebrew (build 17.0.12+0)
OpenJDK 64-Bit Server VM Homebrew (build 17.0.12+0, mixed mode, sharing)

Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)
Maven home: /usr/local/Cellar/maven/3.9.9/libexec
Java version: 17.0.12, vendor: Homebrew, runtime:
/usr/local/Cellar/openjdk@17/17.0.12/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "14.6.1", arch: "x86_64", family: "mac"

Darwin .... 23.6.0 Darwin Kernel Version 23.6.0: Mon Jul 29 21:13:00
PDT 2024; root:xnu-10063.141.2~1/RELEASE_X86_64 x86_64

Gary

On Sat, Aug 31, 2024 at 3:31 PM Piotr P. Karwasz
<piotr.karw...@gmail.com> wrote:
>
> This is a vote to release the Apache Log4j `2.24.0`.
>
> Website: https://logging.staged.apache.org/log4j/2.24.0/index.html
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 08053687456f6be61ee8206da782a3d051928a57
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: 
> https://repository.apache.org/content/repositories/orgapachelogging-1293
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted. At least 3 +1 votes and more
> positive than negative votes are required.
>
> == Review kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
>     # Check out the distribution
>     svn co https://dist.apache.org/repos/dist/dev/logging/log4j/2.24.0 && cd 
> $_
>
>     # Verify checksums
>     shasum --check *.sha512
>
>     # Verify signatures
>     wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
>     for sigFile in *.asc; do gpg --verify $sigFile; done
>
>     # Verify reproduciblity
>     umask 0022
>     unzip *-src.zip -d src
>     cd src
>     export 
> NEXUS_REPO=https://repository.apache.org/content/repositories/orgapachelogging-1293
>     sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>     # If preferred, augment `mvnw` with `-DskipTests` to speed things up
>
> == Release Notes
>
> This release contains improvements and changes in several areas of Apache 
> Log4j:
>
> === Log4j API
>
> The `2.24.0` version of Log4j API has been enhanced with changes from
> the 3.x branch and will be used by both Log4j 2 Core and Log4j 3 Core
> releases.
> The changes include:
>
> * A faster default `ThreadContextMap`.
> * Enhanced GraalVM support: native binaries that use Log4j API will no
> longer require additional GraalVM configuration.
> * The configuration properties subsystem now only accepts the official
> pre-2.10 property names and the normalized post-2.10 names.
> Check your configuration for typos.
>
> === Documentation
>
> The Apache Log4j 2 website has been almost entirely rewritten to
> provide improved documentation and faster access to the information
> you need.
>
> [1] https://logging.staged.apache.org/log4j/2.24.0/index.html
>
> === Bridges
>
> The JUL-to-Log4j API and Log4j 1-to-Log4j API will no longer be able
> to modify the configuration of Log4j Core by default.
> If such a functionality is required, it must be explicitly enabled.
>
> === Modules
>
> The following Log4j Core additional modules have been removed:
>
> `log4j-flume-ng`::
> The module has been moved to the Flume project and follows the Apache
> Flume release lifecycle.
>
> `log4j-kubernetes`::
> The module has been moved to the
> https://github.com/fabric8io/kubernetes-client/blob/main/doc/KubernetesLog4j.md[Fabric8.io
> Kubernetes project] and follows the Fabric8.io release lifecycle.
>
> `log4j-mongodb3`::
> The module based on MongoDB Java client version 3.x has been removed.
> Please migrate to `log4j-mongodb` (client version 5.x) or
> `log4j-mongodb4` (client version 4.x).
>
> === JMX changes
>
> Starting in version 2.24.0, JMX support is disabled by default and can
> be re-enabled via the `log4j2.disableJmx=false` system property.
>
> === Added
>
> * Add a faster `DefaultThreadContextMap` implementation. (#2330)
> * Add Logback throwable-consuming semantics as an option in
> `log4j-slf4j-impl` and `log4j-slf4j2-impl`. Users can enable it by
> setting the property `log4j2.messageFactory` to
> `org.apache.logging.slf4j.message.ThrowableConsumingMessageFactory`.
> (#2363)
> * Add trace context fields to `GcpLayout.json` (#2498)
> * Add _"Plugin Reference"_ to the website. It is a Javadoc-on-steroids
> focusing on Log4j plugins. (#1954)
> * Automate website deployment using the new CI infrastructure shipped
> with `org.apache.logging:logging-parent:11.0.0`
>
> === Changed
>
> * Fix usage of `log4j-api` in GraalVM without additional reachability
> data. (#1539)
> * Ignore exceptions thrown by PropertySources.
> (https://github.com/spring-projects/spring-boot/issues/33450[Spring-33450])
> * Add logging to `PropertiesUtil` and fix `Duration` parser. (#1936)
> * Disable level modification via JUL by default. (#2353)
> * Centralize initialization in the `Provider` class and deprecate
> `log4j2.loggerContextFactory` property. (#2374)
> * Remove `log4j-kubernetes` lookup. User should migrate to
> https://github.com/fabric8io/kubernetes-client/blob/main/doc/KubernetesLog4j.md[`io.fabric8:kubernetes-log4j`].
> (#2412)
> * Disable JMX support by default. Require `log4j2.disableJmx` to be
> set to `false` to enable JMX support. (#2462)
> * Replace some usages of `DateTimeFormatter#toString()` with
> `DateTimeFormatter#formatTo(StringBuilder)` to cut down on allocations
> (#2515)
> * Disable programmatic configuration in Log4j 1 Bridge if
> `log4j1.compatibility` is `false`. (#2778)
> * Improve missing plugin descriptor warnings. (#2835)
> * Remove configuration properties caching and (undocumented) fuzzy
> property name matching. (#2849)
> * Fixes property source ordering to account for different sources with
> the same priority.
> (https://issues.apache.org/jira/browse/LOG4J2-3618[LOG4J2-3618])
> * Prioritize user-defined values of `log4j2.enableThreadLocals`,
> `log4j2.garbagefreeThreadContextMap` and `log4j2.shutdownHookEnabled`
> over the value of `log4j.isWebapp`. (#2517)
> * Disallow duplicate keys in JSON Template Layout templates
> * Deprecate `log4j2.defaultStatusLevel` property in Log4j Core in
> favor of `log4j2.statusLoggerLevel` (#2481)
>
> === Deprecated
>
> * Deprecate `Message#getFormat()` due to unclear semantics and
> inconsistent implementations (#2773)
> * Deprecate `org.apache.logging.log4j.EventLogger` for removal (#2665)
> * Deprecate `org.apache.logging.log4j.core.appender.rolling.action.Duration`
> class for removal (#2425)
> * Deprecate the `log4j-mongodb4` module in favor of `log4j-mongodb` (#2486)
>
> === Fixed
>
> * Use FQDN in RFC5424 Layout. (#1740)
> * Fix custom thread-context data provider handling in lookups and
> filters. (#2331)
> * Fix handling of `log4j2.messageFactory` and
> `log4j2.flowMessageFactory` properties (#2505)
> * Discard blank keys in `PropertiesUtil` (#2414)
> * Fix handling of `log4j2.debug`. (#2703)
> * Fix location requirement for the `%F` and `%file` keys in Pattern
> Layout (#2781)
> * Fix `JsonLayout` failure under JPMS. (#2814)
> * Fix empty string handling for `TruncatingBufferedWriter` (#2609)
> * Fix that parameterized message formatting throws an exception when
> there are insufficient number of parameters. It previously simply
> didn't replace the '{}' sequence. The behavior changed in 2.21.0 and
> should be restored for backward compatibility. (#2380)
> * Fix `ClassCastException` in LMAX Disruptor 3 initialization (#2768)
> * Fix requirement on the `java.management` module when JMX is
> disabled, which is the default (#2775)
> * Website is migrated to Antora with several formatting and link fixes (#2427)
>
> === Removed
>
> * Move Flume Appender to its own release lifecycle. (#2902)
>
> === Updated
>
> * Add module log4j-mongodb to track the current MongoDB driver
> (currently version 5). (#2486)
> * Remove module log4j-mongodb3, use log4j-mongodb instead,
> log4j-mongodb4 is deprecated for removal. (#2486)
> * Update `com.fasterxml.jackson:jackson-bom` to version `2.17.2` (#2719)
> * Update `com.github.luben:zstd-jni` to version `1.5.6-5` (#2901)
> * Update `commons-codec:commons-codec` to version `1.17.1` (#2741)
> * Update `commons-logging:commons-logging` to version `1.3.4` (#2864)
> * Update `github/codeql-action` to version `3.25.1` (#2483)
> * Update `io.fabric8:docker-maven-plugin` to version `0.45.0` (#2776)
> * Update `org.apache.cassandra:cassandra-all` to version `3.11.17` (#2479)
> * Update `org.apache.commons:commons-compress` to version `1.27.1` (#2869)
> * Update `org.apache.commons:commons-csv` to version `1.11.0` (#2565)
> * Update `org.apache.commons:commons-lang3` to version `3.17.0` (#2907)
> * Update `org.apache.kafka:kafka-clients` to version `3.8.0` (#2777)
> * Update `org.apache.logging:logging-parent` to version `11.2.0`
> * Update `org.eclipse.jetty:jetty-bom` to version `9.4.55.v20240627` (#2709)
> * Update `org.jctools:jctools-core` to version `4.0.5` (#2637)
> * Update log4j-mongodb4 `org.mongodb:*` from `4.11.1` to `4.11.2` (#2409)
> * Update `org.mongodb:bson` to version `5.1.3` (#2823)
> * Update `org.slf4j:slf4j-api` to version `2.0.16` (#2829)
> * Update `org.springframework:spring-framework-bom` to version `5.3.39` 
> (#2840)

Reply via email to