Re: [VOTE] Release Apache Log4j Tools 0.7.0

[Volkan Yazıcı]

Adding my +1.

With that, the release passes with 3 binding +1 votes from Piotr, Gary, and
me. I will continue the release process.

On Thu, Dec 14, 2023 at 1:40 PM Volkan Yazıcı  wrote:

> This is a vote to release the Apache Log4j Tools 0.7.0.
>
> Website: https://logging.staged.apache.org/log4j/tools
> GitHub: https://github.com/apache/logging-log4j-tools
> Commit: 04d9a79fb5cadb791c9e66fc671d6c0ffedf7e1e
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools
> Nexus:
> https://repository.apache.org/content/repositories/orgapachelogging-1247
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted. At least 3 +1 votes and more
> positive than negative votes are required.
>
> === Review kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> svn co https://dist.apache.org/repos/... && cd $_
>
> # Verify checksums
> shasum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/...
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> === Release notes
>
> This minor release contains various bug fixes and improvements.
>
>  Added
>
> * Add the new `updated` changelog entry type and bump the XSD version to
> `0.1.3`
>
>  Changed
>
> * Update `commons-io:commons-io` to version `2.15.1` (#86)
> * Update `org.apache.maven.plugin-tools:maven-plugin-annotations` to
> version `3.10.2` (#87)
>
>  Fixed
>
> * Sort changelog entry types alphanumerically
> * Fix `log4j-changelog:release` failure on empty unreleased changelog
> directory (#90)
> * Fix parsing of patch versions in `log4j-changelog:release` goal (#89)
>

Re: [VOTE] Release Apache Log4j 3.0.0-beta1

[Volkan Yazıcı]

Even though the vote was intended for 72 hours, it has been 5 days and
there hasn't been any official votes on the release. I will wait for
another 24 hours and cancel the release. I will appreciate PMC members'
participation in the voting.

On Wed, Dec 13, 2023 at 4:26 PM Volkan Yazıcı  wrote:

> This is a vote to release the Apache Log4j 3.0.0-beta1.
>
> Website: https://logging.staged.apache.org/log4j
> GitHub: https://github.com/apache/logging-log4j2
> Commit: c5dbdcfeb0216e1e3e333436e9b4d04cc3b8e6fd
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus:
> https://repository.apache.org/content/repositories/orgapachelogging-1246
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
>
> == Review Kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> svn co https://dist.apache.org/repos/... && cd $_
>
> # Verify checksums
> shasum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/...
> sh mvnw -Prelease \
> verify artifact:compare \
> -Dreference.repo=$NEXUS_REPO \
> -Dcyclonedx.skip
>
> Some SBOM discrepancy is causing reproducibility mismatch, hence the
> `-Dcyclonedx.skip`. Since `2.x` and `main` are greatly diverged, I couldn't
> figure out the missing piece yet.
>
> == Release Notes
>
> This is the first beta release of the upcoming major release, i.e.,
> `3.0.0`.
>
> === Added
>
> * Add annotations for nullability. (LOG4J2-1477)
> * Remove deprecated code. (LOG4J2-2493)
> * Add a more generalized dependency injection system to plugins inspired
> by JSR 330. (LOG4J2-2803)
> * Add and enhance structured properties for per-context settings outside
> configuration files. (1473)
> * Automate artifact publishing and release preparation. (LOG4J2-3466)
> * Add support for dependency injection of plugins into container types
> such as `Optional`, `Collection`, `Set`, `Stream`, `List`,
> and `Map`. (LOG4J2-3496)
> * Add support for `ConstraintValidator` in plugin classes. (LOG4J2-3497)
>
> === Changed
>
> * Remove liquibase-log4j2 maven module (#1193)
> * Make the output of annotation processing reproducible. (#1520)
> * Replace `synchronized` blocks with locks for improved performance with
> virtual threads. (#1532)
> * Removes additional `isFiltered` checks in `AsyncLoggerConfig`. (#1550)
> * Ignore exceptions thrown by PropertySources. Eliminate
> ClassCastException when SimpleLoggerContext is used.
> (spring-projects/spring-boot#33450, #1799)
> * Update `com.lmax:disruptor` to version `4.0.0` (#1829)
> * Migrate most tests to JUnit 5. This includes a more powerful set of test
> extensions. (LOG4J2-2653)
> * Make Log4j use its own BOM. (LOG4J2-3511)
> * Change encoding of HTTP Basic Authentication to UTF-8. (#1970)
> * Upgraded the required compiler version to Java 17
> * Upgraded the required runtime version to Java 17
> * Update `actions/checkout` to version `4.1.1` (#1869)
> * Update `actions/setup-java` to version `3.13.0` (#1809)
> * Update `actions/setup-python` to version `4.7.1` (#1831)
> * Update `ch.qos.logback:logback-classic` to version `1.4.14` (#2028)
> * Update `com.datastax.cassandra:cassandra-driver-core` to version
> `3.11.5` (#1889)
> * Update `com.fasterxml.jackson:jackson-bom` to version `2.16.0` (#1974)
> * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2032)
> * Update `com.github.spotbugs:spotbugs-maven-plugin` to version `4.7.3.6`
> (#1879)
> * Update `com.github.tomakehurst:wiremock-jre8` to version `2.35.1` (#1765)
> * Update `com.google.errorprone:error_prone_core` to version `2.23.0`
> (#1871)
> * Update `com.google.guava:guava-testlib` to version `32.1.3-jre` (#1934)
> * Update `com.h2database:h2` to version `2.2.224` (#1917)
> * Update `commons-codec:commons-codec` to version `1.16.0` (#2054)
> * Update `commons-io:commons-io` to version `2.15.1` (#2035)
> * Update `commons-logging:commons-logging` to version `1.3.0` (#2046)
> * Update `de.flapdoodle.reverse:de.flapdoodle.reverse` to version `1.7.2`
> (#2000)
> * Update `io.netty:netty-bom` to version `4.1.101.Final` (#1999)
> * Update `net.java.dev.jna:jna` to version `5.14.0` (#2082)
> * Update `org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle`
> to version `1.3.7` (#205

[ANNOUNCE] Apache Log4j Tools 0.7.0 released

[Volkan Yazıcı]

Apache Log4j Tools team is pleased to announce the 0.7.0
release. This project provides tooling internally used by the
Apache Log4j project. For further information (support, download,
etc.) see the project website[1].

[1] https://logging.apache.org/log4j/tools

=== Release Notes

This minor release contains various bug fixes and improvements.

 Added

* Add the new `updated` changelog entry type and bump the XSD version to
`0.1.3`

 Changed

* Update `commons-io:commons-io` to version `2.15.1` (#86)
* Update `org.apache.maven.plugin-tools:maven-plugin-annotations` to
version `3.10.2` (#87)

 Fixed

* Sort changelog entry types alphanumerically
* Fix `log4j-changelog:release` failure on empty unreleased changelog
directory (#90)
* Fix parsing of patch versions in `log4j-changelog:release` goal (#89)

[VOTE][LAZY] Release Apache Logging Parent 10.5.0 (RC3)

[Volkan Yazıcı]

This is a lazy-vote to release the Apache Logging Parent 10.5.0 (RC3).

Website: https://logging.staged.apache.org/logging-parent
GitHub: https://github.com/apache/logging-parent
Commit: e4816c8c364c594359914cad808cf8fa582f1c0d
Distribution: https://dist.apache.org/repos/dist/dev/logging/logging-parent
Nexus:
https://repository.apache.org/content/repositories/orgapachelogging-1250
Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0

Please download, test, and cast your votes on this mailing list.

[ ] +1, release the artifacts
[ ] -1, don't release, because...

This vote is open for 72 hours and will pass unless getting a
net negative vote count. All votes are welcome and we encourage
everyone to test the release, but only the Logging Services PMC
votes are officially counted.

=== Review kit

The minimum set of steps needed to review the uploaded distribution
files in the Subversion repository can be summarized as follows:

# Check out the distribution
svn co https://dist.apache.org/repos/... && cd $_

# Verify checksums
shasum --check *.sha512

# Verify signatures
wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
for sigFile in *.asc; do gpg --verify $sigFile; done

# Verify reproduciblity
umask 0022
unzip *-src.zip -d src
cd src
export NEXUS_REPO=https://repository.apache.org/content/...
sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO

=== Release notes

This minor release contains dependency updates and a change in the way BND
is employed.

BND Maven Plugins are upgraded to version `7.0.0`, which requires Java 17.
Log4j was the blocker for this upgrade and the issue is resolved in
apache/logging-log4j2#2021.
Note that BND Maven Plugins version `7.0.0` increased the minimum required
Maven version to `3.8.1`.

 Changed

* Switch from `bnd:jar` to `bnd:bnd-process` to improve integration with
the ecosystem; IDEs, Maven plugins, etc. (#69)
* Replace `log4j-changelog` entry type of `dependabot` updates from
`changed` to `updated`
* Minimum required Maven version is increased to `3.8.1` due to BND Maven
Plugin updates

 Updated

* Update `biz.aQute.bnd:bnd-baseline-maven-plugin` to version `7.0.0` (#78)
* Update `biz.aQute.bnd:bnd-maven-plugin` to version `7.0.0`
* Update `com.diffplug.spotless:spotless-maven-plugin` to version `2.41.1`
(#70)
* Update `com.github.spotbugs:spotbugs-annotations` to version `4.8.3` (#80)
* Update `com.github.spotbugs:spotbugs-maven-plugin` to version `4.8.2.0`
(#71)
* Update `com.palantir.javaformat:palantir-java-format` to version `2.39.0`
* Update `org.apache:apache` to version `31` (#73)
* Update `org.apache.logging.log4j:log4j-changelog-maven-plugin` to version
`0.7.0` (#84)

Re: [VOTE] Release Apache Log4j 3.0.0-beta1

[Gary Gregory]

Since Piotr asked for a fix and Matt can reproduce the issue, I'm not going
to take the time.to review this RC.

Gary

On Mon, Dec 18, 2023, 3:21 AM Volkan Yazıcı  wrote:

> Even though the vote was intended for 72 hours, it has been 5 days and
> there hasn't been any official votes on the release. I will wait for
> another 24 hours and cancel the release. I will appreciate PMC members'
> participation in the voting.
>
> On Wed, Dec 13, 2023 at 4:26 PM Volkan Yazıcı  wrote:
>
> > This is a vote to release the Apache Log4j 3.0.0-beta1.
> >
> > Website: https://logging.staged.apache.org/log4j
> > GitHub: https://github.com/apache/logging-log4j2
> > Commit: c5dbdcfeb0216e1e3e333436e9b4d04cc3b8e6fd
> > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> > Nexus:
> > https://repository.apache.org/content/repositories/orgapachelogging-1246
> > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> >
> > Please download, test, and cast your votes on this mailing list.
> >
> > [ ] +1, release the artifacts
> > [ ] -1, don't release, because...
> >
> > This vote is open for 72 hours and will pass unless getting a
> > net negative vote count. All votes are welcome and we encourage
> > everyone to test the release, but only the Logging Services PMC
> > votes are officially counted.
> >
> > == Review Kit
> >
> > The minimum set of steps needed to review the uploaded distribution
> > files in the Subversion repository can be summarized as follows:
> >
> > # Check out the distribution
> > svn co https://dist.apache.org/repos/... && cd $_
> >
> > # Verify checksums
> > shasum --check *.sha512
> >
> > # Verify signatures
> > wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> > for sigFile in *.asc; do gpg --verify $sigFile; done
> >
> > # Verify reproduciblity
> > umask 0022
> > unzip *-src.zip -d src
> > cd src
> > export NEXUS_REPO=https://repository.apache.org/content/...
> > sh mvnw -Prelease \
> > verify artifact:compare \
> > -Dreference.repo=$NEXUS_REPO \
> > -Dcyclonedx.skip
> >
> > Some SBOM discrepancy is causing reproducibility mismatch, hence the
> > `-Dcyclonedx.skip`. Since `2.x` and `main` are greatly diverged, I
> couldn't
> > figure out the missing piece yet.
> >
> > == Release Notes
> >
> > This is the first beta release of the upcoming major release, i.e.,
> > `3.0.0`.
> >
> > === Added
> >
> > * Add annotations for nullability. (LOG4J2-1477)
> > * Remove deprecated code. (LOG4J2-2493)
> > * Add a more generalized dependency injection system to plugins inspired
> > by JSR 330. (LOG4J2-2803)
> > * Add and enhance structured properties for per-context settings outside
> > configuration files. (1473)
> > * Automate artifact publishing and release preparation. (LOG4J2-3466)
> > * Add support for dependency injection of plugins into container types
> > such as `Optional`, `Collection`, `Set`, `Stream`, `List`,
> > and `Map`. (LOG4J2-3496)
> > * Add support for `ConstraintValidator` in plugin classes. (LOG4J2-3497)
> >
> > === Changed
> >
> > * Remove liquibase-log4j2 maven module (#1193)
> > * Make the output of annotation processing reproducible. (#1520)
> > * Replace `synchronized` blocks with locks for improved performance with
> > virtual threads. (#1532)
> > * Removes additional `isFiltered` checks in `AsyncLoggerConfig`. (#1550)
> > * Ignore exceptions thrown by PropertySources. Eliminate
> > ClassCastException when SimpleLoggerContext is used.
> > (spring-projects/spring-boot#33450, #1799)
> > * Update `com.lmax:disruptor` to version `4.0.0` (#1829)
> > * Migrate most tests to JUnit 5. This includes a more powerful set of
> test
> > extensions. (LOG4J2-2653)
> > * Make Log4j use its own BOM. (LOG4J2-3511)
> > * Change encoding of HTTP Basic Authentication to UTF-8. (#1970)
> > * Upgraded the required compiler version to Java 17
> > * Upgraded the required runtime version to Java 17
> > * Update `actions/checkout` to version `4.1.1` (#1869)
> > * Update `actions/setup-java` to version `3.13.0` (#1809)
> > * Update `actions/setup-python` to version `4.7.1` (#1831)
> > * Update `ch.qos.logback:logback-classic` to version `1.4.14` (#2028)
> > * Update `com.datastax.cassandra:cassandra-driver-core` to version
> > `3.11.5` (#1889)
> > * Update `com.fasterxml.jackson:jackson-bom` to version `2.16.0` (#1974)
> > * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2032)
> > * Update `com.github.spotbugs:spotbugs-maven-plugin` to version `4.7.3.6`
> > (#1879)
> > * Update `com.github.tomakehurst:wiremock-jre8` to version `2.35.1`
> (#1765)
> > * Update `com.google.errorprone:error_prone_core` to version `2.23.0`
> > (#1871)
> > * Update `com.google.guava:guava-testlib` to version `32.1.3-jre` (#1934)
> > * Update `com.h2database:h2` to version `2.2.224` (#1917)
> > * Update `commons-codec:commons-codec` to version `1.16.0` (#2054)
> > * Update `commons-io:commons-io` to version `2.15.1` (#2

20 years of Log4j: Happy anniversary folks!

[Christian Grobmeier]

Happy anniversary, folks!

Yesterday, on 17.12.2003, the ASF accepted our project, and Log4j was born. 

Twenty years later, this community is not only vibrant but growing.

I have met many great people in this project and continue to learn from our 
user base, committers, and PMC members.

Therefore, thank you for being around and making this community as great as it 
is.

We have two celebration blogs:

https://logging.apache.org/blog/2023/12/18/20-years-of-innovation.html

And the official one:
https://news.apache.org/foundation/entry/apache-logging-services-celebrates-20th-anniversary-of-log4j

Cheers,
Christian

All-in-one site documentation

[Gary D. Gregory]

Hi All,

A while back, I mentioned that we could (not should) have our documentation 
generated within Javadoc. Here is an example from another Apache project I 
participate in: 

https://juneau.apache.org/site/apidocs-9.0.1/index.html

I'm late to Juneau and I don't know the ins and out of how it's made, but it 
looks good nonetheless IMO.

Gary

Re: All-in-one site documentation

[Gary D. Gregory]

FYI 
https://cwiki.apache.org/confluence/display/JUNEAU/Adding+content+to+the+overview-summary.html+file

On 2023/12/18 17:37:36 "Gary D. Gregory" wrote:
> Hi All,
> 
> A while back, I mentioned that we could (not should) have our documentation 
> generated within Javadoc. Here is an example from another Apache project I 
> participate in: 
> 
> https://juneau.apache.org/site/apidocs-9.0.1/index.html
> 
> I'm late to Juneau and I don't know the ins and out of how it's made, but it 
> looks good nonetheless IMO.
> 
> Gary
> 

Re: All-in-one site documentation

[Matt Sicker]

This is pretty cool!

> On Dec 18, 2023, at 11:37 AM, Gary D. Gregory  wrote:
> 
> Hi All,
> 
> A while back, I mentioned that we could (not should) have our documentation 
> generated within Javadoc. Here is an example from another Apache project I 
> participate in: 
> 
> https://juneau.apache.org/site/apidocs-9.0.1/index.html
> 
> I'm late to Juneau and I don't know the ins and out of how it's made, but it 
> looks good nonetheless IMO.
> 
> Gary

[log4j] Revamping Log4j website & manual

[Volkan Yazıcı]

*TLDR:* Log4j websites & manual will be rewritten. Feedback and support are
more than welcome.

Starting from February, Christian, Piotr, and I will be working on
reorganizing the Log4j websites (Log4j, Log4j Scala, Log4j Tools, etc.) and
rewriting the Log4j manual. Many implementation details are still yet to be
decided and we look forward to pursuing this big undertaking with the help
of other PMC members and our community.

I want to kick-off this project using the following agenda:

   1. An email thread on *website & manual reorganization* – What are the
   current shortcomings? Shall we have global support, security, etc. pages?
   Do we need separate pages for distribution details of each project? Where
   shall we place `logging-parent`? What about release instructions?
   2. An email thread on *tooling* – What are the requirements? What are
   the available solutions in the market?
   3. A *video call* for resolution – Q&A. Fleshing out a plan forward.
   4. An email sharing the *conclusive plan* in detail.

If you have general feedback that doesn't fit into aforementioned
reorganization- and tooling-related discussions, please go ahead and share
them in response to this post.

Re: All-in-one site documentation

[Volkan Yazıcı]

Thanks for the heads up Gary. I was (and still am!) a big fan of utilizing
Javadoc for the manual. This is pretty relevant for the website revamp
email I just shared. I will explore the Juneau approach in detail and share
my findings in the tooling-related thread I intend to send sometime this
week.

On Mon, Dec 18, 2023 at 6:37 PM Gary D. Gregory  wrote:

> Hi All,
>
> A while back, I mentioned that we could (not should) have our
> documentation generated within Javadoc. Here is an example from another
> Apache project I participate in:
>
> https://juneau.apache.org/site/apidocs-9.0.1/index.html
>
> I'm late to Juneau and I don't know the ins and out of how it's made, but
> it looks good nonetheless IMO.
>
> Gary
>

Re: [log4j] Revamping Log4j website & manual

[Matt Sicker]

I’d be interesting in helping with this, particularly around plugin development 
docs which are somewhat anemic. I’ve got several things to document in a 
non-API-doc fashion from the new DI system and such, too.

> On Dec 18, 2023, at 1:13 PM, Volkan Yazıcı  wrote:
> 
> *TLDR:* Log4j websites & manual will be rewritten. Feedback and support are
> more than welcome.
> 
> Starting from February, Christian, Piotr, and I will be working on
> reorganizing the Log4j websites (Log4j, Log4j Scala, Log4j Tools, etc.) and
> rewriting the Log4j manual. Many implementation details are still yet to be
> decided and we look forward to pursuing this big undertaking with the help
> of other PMC members and our community.
> 
> I want to kick-off this project using the following agenda:
> 
>   1. An email thread on *website & manual reorganization* – What are the
>   current shortcomings? Shall we have global support, security, etc. pages?
>   Do we need separate pages for distribution details of each project? Where
>   shall we place `logging-parent`? What about release instructions?
>   2. An email thread on *tooling* – What are the requirements? What are
>   the available solutions in the market?
>   3. A *video call* for resolution – Q&A. Fleshing out a plan forward.
>   4. An email sharing the *conclusive plan* in detail.
> 
> If you have general feedback that doesn't fit into aforementioned
> reorganization- and tooling-related discussions, please go ahead and share
> them in response to this post.

Re: [VOTE] Release Apache Log4j 3.0.0-beta1

[Matt Sicker]

We can review this without doing a reproducibility check. The signatures of 
everything look good; just doing some final validations before voting.

> On Dec 18, 2023, at 6:38 AM, Gary Gregory  wrote:
> 
> Since Piotr asked for a fix and Matt can reproduce the issue, I'm not going
> to take the time.to review this RC.
> 
> Gary
> 
> On Mon, Dec 18, 2023, 3:21 AM Volkan Yazıcı  wrote:
> 
>> Even though the vote was intended for 72 hours, it has been 5 days and
>> there hasn't been any official votes on the release. I will wait for
>> another 24 hours and cancel the release. I will appreciate PMC members'
>> participation in the voting.
>> 
>> On Wed, Dec 13, 2023 at 4:26 PM Volkan Yazıcı  wrote:
>> 
>>> This is a vote to release the Apache Log4j 3.0.0-beta1.
>>> 
>>> Website: https://logging.staged.apache.org/log4j
>>> GitHub: https://github.com/apache/logging-log4j2
>>> Commit: c5dbdcfeb0216e1e3e333436e9b4d04cc3b8e6fd
>>> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
>>> Nexus:
>>> https://repository.apache.org/content/repositories/orgapachelogging-1246
>>> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>>> 
>>> Please download, test, and cast your votes on this mailing list.
>>> 
>>> [ ] +1, release the artifacts
>>> [ ] -1, don't release, because...
>>> 
>>> This vote is open for 72 hours and will pass unless getting a
>>> net negative vote count. All votes are welcome and we encourage
>>> everyone to test the release, but only the Logging Services PMC
>>> votes are officially counted.
>>> 
>>> == Review Kit
>>> 
>>> The minimum set of steps needed to review the uploaded distribution
>>> files in the Subversion repository can be summarized as follows:
>>> 
>>># Check out the distribution
>>>svn co https://dist.apache.org/repos/... && cd $_
>>> 
>>># Verify checksums
>>>shasum --check *.sha512
>>> 
>>># Verify signatures
>>>wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
>>>for sigFile in *.asc; do gpg --verify $sigFile; done
>>> 
>>># Verify reproduciblity
>>>umask 0022
>>>unzip *-src.zip -d src
>>>cd src
>>>export NEXUS_REPO=https://repository.apache.org/content/...
>>>sh mvnw -Prelease \
>>>verify artifact:compare \
>>>-Dreference.repo=$NEXUS_REPO \
>>>-Dcyclonedx.skip
>>> 
>>> Some SBOM discrepancy is causing reproducibility mismatch, hence the
>>> `-Dcyclonedx.skip`. Since `2.x` and `main` are greatly diverged, I
>> couldn't
>>> figure out the missing piece yet.
>>> 
>>> == Release Notes
>>> 
>>> This is the first beta release of the upcoming major release, i.e.,
>>> `3.0.0`.
>>> 
>>> === Added
>>> 
>>> * Add annotations for nullability. (LOG4J2-1477)
>>> * Remove deprecated code. (LOG4J2-2493)
>>> * Add a more generalized dependency injection system to plugins inspired
>>> by JSR 330. (LOG4J2-2803)
>>> * Add and enhance structured properties for per-context settings outside
>>> configuration files. (1473)
>>> * Automate artifact publishing and release preparation. (LOG4J2-3466)
>>> * Add support for dependency injection of plugins into container types
>>> such as `Optional`, `Collection`, `Set`, `Stream`, `List`,
>>> and `Map`. (LOG4J2-3496)
>>> * Add support for `ConstraintValidator` in plugin classes. (LOG4J2-3497)
>>> 
>>> === Changed
>>> 
>>> * Remove liquibase-log4j2 maven module (#1193)
>>> * Make the output of annotation processing reproducible. (#1520)
>>> * Replace `synchronized` blocks with locks for improved performance with
>>> virtual threads. (#1532)
>>> * Removes additional `isFiltered` checks in `AsyncLoggerConfig`. (#1550)
>>> * Ignore exceptions thrown by PropertySources. Eliminate
>>> ClassCastException when SimpleLoggerContext is used.
>>> (spring-projects/spring-boot#33450, #1799)
>>> * Update `com.lmax:disruptor` to version `4.0.0` (#1829)
>>> * Migrate most tests to JUnit 5. This includes a more powerful set of
>> test
>>> extensions. (LOG4J2-2653)
>>> * Make Log4j use its own BOM. (LOG4J2-3511)
>>> * Change encoding of HTTP Basic Authentication to UTF-8. (#1970)
>>> * Upgraded the required compiler version to Java 17
>>> * Upgraded the required runtime version to Java 17
>>> * Update `actions/checkout` to version `4.1.1` (#1869)
>>> * Update `actions/setup-java` to version `3.13.0` (#1809)
>>> * Update `actions/setup-python` to version `4.7.1` (#1831)
>>> * Update `ch.qos.logback:logback-classic` to version `1.4.14` (#2028)
>>> * Update `com.datastax.cassandra:cassandra-driver-core` to version
>>> `3.11.5` (#1889)
>>> * Update `com.fasterxml.jackson:jackson-bom` to version `2.16.0` (#1974)
>>> * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2032)
>>> * Update `com.github.spotbugs:spotbugs-maven-plugin` to version `4.7.3.6`
>>> (#1879)
>>> * Update `com.github.tomakehurst:wiremock-jre8` to version `2.35.1`
>> (#1765)
>>> * Update `com.google.errorprone:error_prone_core` to version `2.23.0`
>>> (#1871)
>>> * Update `com.google.guava:guava-tes

Re: [log4j] Revamping Log4j website & manual

[Gary Gregory]

When I read "pages", "site", and do on, I am reminded of the model-view
paradigm. I would offer that we focus on _content_ first, and write that
content in some general format that tooling can then be used to generate a
site, a PDF, Javadoc, whatever.

FWIW, when I worked on the "Java Persistence with Hibernate" book, we wrote
everything in XHTML and used tooling called lemma to produce a PDF. This
was all in a Maven project, which contained all of the book's Java code,
which was compiled and tested like a plain old Java app. The Java source
code contains special comments that allowed the tooling to "code slurp" the
Java source and combine it with the XHTML to produce the book output.

All very cool since the Java examples for the book were as "real" as
possible, guaranteed to work, otherwise building the book would fail!.

2c,
Gary

On Mon, Dec 18, 2023, 2:15 PM Volkan Yazıcı  wrote:

> *TLDR:* Log4j websites & manual will be rewritten. Feedback and support are
> more than welcome.
>
> Starting from February, Christian, Piotr, and I will be working on
> reorganizing the Log4j websites (Log4j, Log4j Scala, Log4j Tools, etc.) and
> rewriting the Log4j manual. Many implementation details are still yet to be
> decided and we look forward to pursuing this big undertaking with the help
> of other PMC members and our community.
>
> I want to kick-off this project using the following agenda:
>
>1. An email thread on *website & manual reorganization* – What are the
>current shortcomings? Shall we have global support, security, etc.
> pages?
>Do we need separate pages for distribution details of each project?
> Where
>shall we place `logging-parent`? What about release instructions?
>2. An email thread on *tooling* – What are the requirements? What are
>the available solutions in the market?
>3. A *video call* for resolution – Q&A. Fleshing out a plan forward.
>4. An email sharing the *conclusive plan* in detail.
>
> If you have general feedback that doesn't fit into aforementioned
> reorganization- and tooling-related discussions, please go ahead and share
> them in response to this post.
>

Re: [VOTE] Release Apache Log4j 3.0.0-beta1

[Matt Sicker]

+1

> On Dec 18, 2023, at 2:45 PM, Matt Sicker  wrote:
> 
> We can review this without doing a reproducibility check. The signatures of 
> everything look good; just doing some final validations before voting.
> 
>> On Dec 18, 2023, at 6:38 AM, Gary Gregory  wrote:
>> 
>> Since Piotr asked for a fix and Matt can reproduce the issue, I'm not going
>> to take the time.to review this RC.
>> 
>> Gary
>> 
>> On Mon, Dec 18, 2023, 3:21 AM Volkan Yazıcı  wrote:
>> 
>>> Even though the vote was intended for 72 hours, it has been 5 days and
>>> there hasn't been any official votes on the release. I will wait for
>>> another 24 hours and cancel the release. I will appreciate PMC members'
>>> participation in the voting.
>>> 
>>> On Wed, Dec 13, 2023 at 4:26 PM Volkan Yazıcı  wrote:
>>> 
 This is a vote to release the Apache Log4j 3.0.0-beta1.
 
 Website: https://logging.staged.apache.org/log4j
 GitHub: https://github.com/apache/logging-log4j2
 Commit: c5dbdcfeb0216e1e3e333436e9b4d04cc3b8e6fd
 Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
 Nexus:
 https://repository.apache.org/content/repositories/orgapachelogging-1246
 Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
 
 Please download, test, and cast your votes on this mailing list.
 
 [ ] +1, release the artifacts
 [ ] -1, don't release, because...
 
 This vote is open for 72 hours and will pass unless getting a
 net negative vote count. All votes are welcome and we encourage
 everyone to test the release, but only the Logging Services PMC
 votes are officially counted.
 
 == Review Kit
 
 The minimum set of steps needed to review the uploaded distribution
 files in the Subversion repository can be summarized as follows:
 
   # Check out the distribution
   svn co https://dist.apache.org/repos/... && cd $_
 
   # Verify checksums
   shasum --check *.sha512
 
   # Verify signatures
   wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
   for sigFile in *.asc; do gpg --verify $sigFile; done
 
   # Verify reproduciblity
   umask 0022
   unzip *-src.zip -d src
   cd src
   export NEXUS_REPO=https://repository.apache.org/content/...
   sh mvnw -Prelease \
   verify artifact:compare \
   -Dreference.repo=$NEXUS_REPO \
   -Dcyclonedx.skip
 
 Some SBOM discrepancy is causing reproducibility mismatch, hence the
 `-Dcyclonedx.skip`. Since `2.x` and `main` are greatly diverged, I
>>> couldn't
 figure out the missing piece yet.
 
 == Release Notes
 
 This is the first beta release of the upcoming major release, i.e.,
 `3.0.0`.
 
 === Added
 
 * Add annotations for nullability. (LOG4J2-1477)
 * Remove deprecated code. (LOG4J2-2493)
 * Add a more generalized dependency injection system to plugins inspired
 by JSR 330. (LOG4J2-2803)
 * Add and enhance structured properties for per-context settings outside
 configuration files. (1473)
 * Automate artifact publishing and release preparation. (LOG4J2-3466)
 * Add support for dependency injection of plugins into container types
 such as `Optional`, `Collection`, `Set`, `Stream`, `List`,
 and `Map`. (LOG4J2-3496)
 * Add support for `ConstraintValidator` in plugin classes. (LOG4J2-3497)
 
 === Changed
 
 * Remove liquibase-log4j2 maven module (#1193)
 * Make the output of annotation processing reproducible. (#1520)
 * Replace `synchronized` blocks with locks for improved performance with
 virtual threads. (#1532)
 * Removes additional `isFiltered` checks in `AsyncLoggerConfig`. (#1550)
 * Ignore exceptions thrown by PropertySources. Eliminate
 ClassCastException when SimpleLoggerContext is used.
 (spring-projects/spring-boot#33450, #1799)
 * Update `com.lmax:disruptor` to version `4.0.0` (#1829)
 * Migrate most tests to JUnit 5. This includes a more powerful set of
>>> test
 extensions. (LOG4J2-2653)
 * Make Log4j use its own BOM. (LOG4J2-3511)
 * Change encoding of HTTP Basic Authentication to UTF-8. (#1970)
 * Upgraded the required compiler version to Java 17
 * Upgraded the required runtime version to Java 17
 * Update `actions/checkout` to version `4.1.1` (#1869)
 * Update `actions/setup-java` to version `3.13.0` (#1809)
 * Update `actions/setup-python` to version `4.7.1` (#1831)
 * Update `ch.qos.logback:logback-classic` to version `1.4.14` (#2028)
 * Update `com.datastax.cassandra:cassandra-driver-core` to version
 `3.11.5` (#1889)
 * Update `com.fasterxml.jackson:jackson-bom` to version `2.16.0` (#1974)
 * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2032)
 * Update `com.github.spotbugs:spotbugs-maven-plugin` to version `4.7.3.6`
 (#1879)
 * Update `com.github.tomakehurst:wiremock-j

Re: [log4j-kotlin] Next release (`1.3.1`-vs-`1.4.0`)

[Raman Gupta]

Thanks Volkan -- Matt, I believe release 1.4.0 is ready for a vote.

* ASF staging site:
https://logging.staged.apache.org/log4j/kotlin/latest/#release-notes-1-4-0
  (from branch
https://github.com/apache/logging-log4j-kotlin/commits/asf-staging/)
* Signed distribution and checksums:
https://dist.apache.org/repos/dist/dev/logging/log4j-kotlin/
* Staging repo is orgapachelogging-1251 (closed)

Regards,
Raman


On Tue, Dec 12, 2023 at 3:33 AM Volkan Yazıcı  wrote:

> Thanks for the prompt action. 🙏
> I will review the PR.
>
> Please keep in mind that you don't have sufficient rights to complete a
> release. A PMC member should volunteer as an RM (Release Manager), who, in
> your case, is Matt, I presume. That is, you can perform the git chores, but
> it is Matt who should do the rest of the release instructions
> .
>
> On Mon, Dec 11, 2023 at 11:53 PM Raman Gupta 
> wrote:
>
>> Thanks for the feedback Volkan. The PR with all of these changes is:
>>
>> https://github.com/apache/logging-log4j-kotlin/pull/56
>>
>> Regards,
>> Raman
>>
>> On Thu, Dec 7, 2023 at 5:54 AM Volkan Yazıcı  wrote:
>>
>>> Raman, Matt, great that you want to release the next version of the
>>> Log4j Kotlin! Thanks for your time and effort.
>>>
>>> I see that you forked the `release/1.3.1` branch from the `rel/1.3.0`
>>> tag, though this misses some minor, but important  changes (e.g., SBOM &
>>> VDR!) from `main`. I suggest we fork from `main` and release `1.4.0`
>>> instead.
>>>
>>
>> Done
>>
>>
>>> There are some chores that have been waiting for the next release to be
>>> performed. I will share them below and appreciate it if you can carry them
>>> out.
>>>
>>> *Add `project.build.outputTimestamp` Maven property*
>>>
>>> Please copy this property (incl. the large comment block preceding it!)
>>> from the `2.x` branch of the `logging-log4j2` repository and incorporate it
>>> into `/pom.xml` of `log4j-kotlin`. Try to place it exactly at the same
>>> location: right after `revision`.
>>>
>>> I might sound pedantic about this and I am. I try really hard to make
>>> all `pom.xml`s look alike to avoid the surprise factor maintainers suffer
>>> from while jumping from one project to another. Not to mention this also
>>> helps us to carry out automation, e.g., `project.build.outputTimestamp` is
>>> replaced by `logging-parent` CI magic during release.
>>>
>>>
>> Done
>>
>>
>>> *Remove `cyclonedx-maven-plugin` override*
>>>
>>> Remove the `cyclonedx-maven-plugin` override (and the comment block
>>> preceding it) from `/pom.xml`. This is not necessary anymore with the
>>> `logging-parent` version `0.4.0` release.
>>>
>>
>> Done
>>
>>
>>>
>>> *Changelog cleanup*
>>>
>>> Make sure `src/changelog/.1.x.x` contents look good. You can verify this
>>> by skimming through `src/site` after issuing a `./mvnw process-sources`.
>>>
>>> Could you update all changelog XSDs to version `0.1.2` too, please?
>>>
>>> I would also appreciate it if you can remove all `author` elements from
>>> `src/changelog/*/*.xml` files. They are neither rendered by the template,
>>> nor provide information that one cannot obtain from the associated
>>> commit/ticket.
>>>
>>
>> Done
>>
>>
>>>
>>> *Generated emails*
>>>
>>> Please don't send generated emails verbatim! Nexus URLs need to be
>>> manually filled in and there are always some minor formatting details to
>>> fix in the text.
>>>
>>
>> Will keep this in mind.
>>
>> Thanks,
>> Raman
>>
>>
>