Re: [VOTE] Release log4net 2.0.14

Thanks Matt Since you've given a +1, I'll write up some sticky notes to address these points in the near future. -d On December 19, 2021 23:51:45 Matt Sicker wrote: +1 Notes on the release: * I’ve copied your release signing key to the root logging KEYS file for easier discoverability.

Re: Building log4j from source on mac? (toolchain.xml madness!)

Also, make sure you are building the release-2.x branch. The master branch will build with Maven and targets Java 11 but it u ses some strange mechanics to get around the quirks of JPMS and this will make it a mess in your IDE. Once things get back to normal I plan to fix up the master branch u

Re: Building log4j from source on mac? (toolchain.xml madness!)

You must run the build with Java 8 as the default JDK. You need a toolchain for Java 9 or greater. I’d recommend Java 11. Ralph > On Dec 19, 2021, at 10:53 PM, Dan Kegel wrote: > > Hi all! > > I'm trying to write an ide-free shell script to reproducibly build log4j from > git on a fresh mac,

Building log4j from source on mac? (toolchain.xml madness!)

Hi all! I'm trying to write an ide-free shell script to reproducibly build log4j from git on a fresh mac, following https://logging.apache.org/log4j/2.x/build.html and filling in the blanks. My current draft, http://kegel.com/install-log4j2-mac.sh.txt installs https://download.oracle.com/java/17/

Re: [VOTE][LAZY] Release Apache Logging Parent POM version 4 rc1

This isn’t security related. — Matt Sicker > On Dec 19, 2021, at 18:22, Gary Gregory wrote: > > Should the mailing lists include the security list? > > Gary > >> On Sun, Dec 19, 2021, 17:40 Matt Sicker wrote: >> >> Hi all, this is a lazy vote to release the latest changes to our common >>

Re: Log4J 1.x progress, pull request(s), plans

Improving legacy compatibility is what I've been pushing. I agree with Matt. IMO resurrecting 1.x sets a bad precedent and is a proverbial can of worms. Gary On Sun, Dec 19, 2021, 17:55 Matt Sicker wrote: > The alternative is to polish the 1.x compatibility in 2.x which is both > actively maint

Re: [VOTE][LAZY] Release Apache Logging Parent POM version 4 rc1

Should the mailing lists include the security list? Gary On Sun, Dec 19, 2021, 17:40 Matt Sicker wrote: > Hi all, this is a lazy vote to release the latest changes to our common > parent POM. The changes in this release are all the same changes made > between the Apache parent pom versions 23 t

Re: Log4J 1.x progress, pull request(s), plans

>Wouldn’t enabling issues imply that issues can be filed for an EOL component? You can configure a filter to delete the mails automatically. On the other hand, it would be nice to know if there are issues like memory leak. I do not see a strong need for issue tracker yet. I just wanted to clarif

Re: Log4J 1.x progress, pull request(s), plans

Wouldn’t enabling issues imply that issues can be filed for an EOL component? I don’t see the difference between enabling issues and writing them to /dev/null besides unnecessary emails. -- Matt Sicker > On Dec 19, 2021, at 17:23, Vladimir Sitnikov > wrote: > >> reactivate Bugzilla or create

Re: Log4J 1.x progress, pull request(s), plans

>reactivate Bugzilla or create a Jira for Log4j 1, movie it to GitHub, etc. "Moving to GitHub" is a no-op, as the current git mirror is ok. Bugzilla and JIRA are not needed. GitHub Issues can be activated via single line in asf.yml All this is trivial thanks to the infra team. Vladimir

Re: Log4J 1.x progress, pull request(s), plans

> On Dec 19, 2021, at 3:48 PM, Vladimir Sitnikov > wrote: > > Matt>but at least one release using the normal ASF release requirements is > required to graduate. > > Thanks for the reminder, and I am sure preparing the release won't be an > issue. I refactored release scripts for both Calcite

Re: [VOTE][LAZY] Release Apache Logging Parent POM version 4 rc1

My not lazy +1 Ralph > On Dec 19, 2021, at 3:40 PM, Matt Sicker wrote: > > Hi all, this is a lazy vote to release the latest changes to our common > parent POM. The changes in this release are all the same changes made between > the Apache parent pom versions 23 to 24 >

Re: Log4J 1.x progress, pull request(s), plans

>The alternative is to polish the 1.x compatibility in 2.x Making sure the compatibility is 100% would be way harder than reincubating 1.x "maintaining" and "releasing" 1.x is not hard (e.g. I can do it), so I do not buy "1.x is not maintained". Vladimir

Re: Log4J 1.x progress, pull request(s), plans

The alternative is to polish the 1.x compatibility in 2.x which is both actively maintained and much easier to get releases published. Then users on 1.x can more easily upgrade to 2.x. I can almost guarantee that regardless of how many warnings we add to a potential 1.x release, we’ll get inunda

[VOTE] Release Log4j Kotlin API 1.2.0-rc2

This is a vote to release Log4j Kotlin API version 1.2.0, the next version of the Kotlin facade for Log4j2. Please download, test, and cast your votes on the log4j developers list. [] +1, release the artifacts [] -1, don't release because... The vote will remain open for 72 hours (or more if req

Re: Log4J 1.x progress, pull request(s), plans

Matt>but at least one release using the normal ASF release requirements is required to graduate. Thanks for the reminder, and I am sure preparing the release won't be an issue. I refactored release scripts for both Calcite and JMeter, and I am sure log4j 1.x is doable. >compared to the alternativ

[VOTE][LAZY] Release Apache Logging Parent POM version 4 rc1

Hi all, this is a lazy vote to release the latest changes to our common parent POM. The changes in this release are all the same changes made between the Apache parent pom versions 23 to 24

Re: Multiple KEYS files

On Sun, 19 Dec 2021 at 21:53, Matt Sicker wrote: > > Yes, I’ve migrated at least one relevant key for log4net into the root keys > file. As log4php is dormant, that other keys file may no longer be necessary. > I’ll clean up the remaining bits and symlink the canonical keys file instead. KEYS f

Re: Zero-copy rolling files

I think the NIO API for symlinks on Windows correspond to the ones that require admin permissions to create. There are also file junctions that are a feature of NTFS, though I’m not sure if there’s any way to create them besides invoking cmd and running a mklink command from there (which, as it

Re: Log4J 1.x progress, pull request(s), plans

I think PDFBox and/or POI did something like that with XML Beans. Gary On Sun, Dec 19, 2021 at 5:10 PM Matt Sicker wrote: > > I thought there was some old XML library that was resurrected here at Apache > because other PMCs were still using it as a dependency. That might have been > more so re

Re: Log4J 1.x progress, pull request(s), plans

I thought there was some old XML library that was resurrected here at Apache because other PMCs were still using it as a dependency. That might have been more so related to the Attic. Anyways, as can be seen already, making non-controversial changes to 1.x that both the PMC and our users could

Re: Multiple KEYS files

Thank Matt for hoovering up our debt, and thanks Sebb for pointing it out! Gary On Sun, Dec 19, 2021 at 4:54 PM Matt Sicker wrote: > > Yes, I’ve migrated at least one relevant key for log4net into the root keys > file. As log4php is dormant, that other keys file may no longer be necessary. > I

Re: Log4J 1.x progress, pull request(s), plans

WRT words, IIRC Apache only has top-level projects (for example, Apache Logging Services, Apache Commons, Apache HttpComponents), within that you can have components, not other projects, for example, Apache Log4j, Apache Commons IO, Apache HttpComponents HttpCore. Gary On Sun, Dec 19, 2021 at 4:2

Re: Multiple KEYS files

Yes, I’ve migrated at least one relevant key for log4net into the root keys file. As log4php is dormant, that other keys file may no longer be necessary. I’ll clean up the remaining bits and symlink the canonical keys file instead. -- Matt Sicker > On Dec 19, 2021, at 15:46, sebb wrote: > > Th

Re: [VOTE] Release Log4j Kotlin API 1.2.0-rc1

I’m going to cancel this release vote to make some dependency updates, ensure the rat check passes, and roll a new release candidate. -- Matt Sicker > On Dec 14, 2021, at 21:27, Raman Gupta wrote: > > +1 > > On Tue, Dec 14, 2021 at 12:38 AM Matt Sicker > wrote: > >>

Re: [VOTE] Release log4net 2.0.14

+1 Notes on the release: * I’ve copied your release signing key to the root logging KEYS file for easier discoverability. * The copyright year in the NOTICE file is a few years out of date at this point. I’ve updated this in master, though you’ll want to update this again in a couple weeks when

Multiple KEYS files

The logging project currently has 3 KEYS files under https://dist.apache.org/repos/dist/release/logging KEYS log4net/KEYS log4php/KEYS Ideally these should be combined at the top level and redirects added. Sebb

Re: [VOTE] Release log4net 2.0.14

I’ve added Davyd’s key to the logging KEYS file. It appears I had already signed it a while back but hadn’t copied it to this KEYS file already. Do note that his key was available in https://downloads.apache.org/logging/log4net/KEYS which isn’t

Re: Log4J 1.x progress, pull request(s), plans

The Logging Services project is an “umbrella” project that manages all the logging projects, including Log4j 1.x. We would not be in favor of having Log4j 1.x become a new standalone PMC. But yes, any Logging Services PMC member can veto a code change in any of the sub-projects. I don’t know

Re: Log4J 1.x progress, pull request(s), plans

>All new ASF projects go through the incubator. Sub-projects don’t have to but when an entirely new community is being I'm a member of PMC Calcite and JMeter, however, I have not submitted projects to the incubator yet. > Once graduated the podling PMC members would become part of the Logging Ser

Re: StrSubstitutor recursion

I've raised a PR at https://github.com/apache/logging-log4j2/pull/644, let me know what you think. Den søn. 19. dec. 2021 kl. 17.19 skrev Ralph Goers < ralph.go...@dslextreme.com>: > Yes. Even setting it to a ridiculous number like 10 would prevent a lot of > problems. > > Ralph > > > On Dec 19,

Re: Log4J 1.x progress, pull request(s), plans

I should have said, you would have to publish at least one release in the incubator to qualify to graduate. Once graduated the podling PMC members would become part of the Logging Services PMC. Ralph > On Dec 19, 2021, at 2:00 PM, Ralph Goers wrote: > > The process is that a form gets filled

Re: Log4J 1.x progress, pull request(s), plans

The process is that a form gets filled out in the Incubator’s Confluence wiki. The form lists the proposed podling PMC members. It isn’t strange at all for the people to then send an email to the incubator list. If that is what you are contemplating then you should start at https://incubator.a

Re: Log4J 1.x progress, pull request(s), plans

On Sun, Dec 19, 2021 at 3:33 PM Vladimir Sitnikov wrote: > > Ralph>if you want to resurrect the project then this really should go > through > Ralph>the ASF incubator with the Logging Services project as the sponsor > > Ralph, > Do you think you know similar cases? > Could you please suggest the p

Re: Log4J 1.x progress, pull request(s), plans

Ralph>if you want to resurrect the project then this really should go through Ralph>the ASF incubator with the Logging Services project as the sponsor Ralph, Do you think you know similar cases? Could you please suggest the procedure for resurrection? I guess it would look strange if I submit a m

Re: StrSubstitutor recursion

Yes. Even setting it to a ridiculous number like 10 would prevent a lot of problems. Ralph > On Dec 19, 2021, at 9:17 AM, Stig Rohde Døssing > wrote: > > Hi Ralph, > > Thank you for elaborating, that makes sense, and I can see how that is > useful. Limiting recursion to some small number of

Re: Zero-copy rolling files

I think this would need to be a different rollover strategy. I am guessing it would be another implementation of DirectFileRolloverStrategy. Ralph > On Dec 19, 2021, at 7:33 AM, Gary Gregory wrote: > > On Sun, Dec 19, 2021 at 9:03 AM Jochen Wiedmann > wrote: >> >> Having worked with symbolic

Re: StrSubstitutor recursion

Hi Ralph, Thank you for elaborating, that makes sense, and I can see how that is useful. Limiting recursion to some small number of levels, as a default controlled by system property (or some other mechanism), still seems like it could be worthwhile, it would close any potential for the issue in

Re: StrSubstitutor recursion

Something like a setting in the prop file itself or yet another system property "variable substitution depth"? Gary On Sun, Dec 19, 2021, 11:10 Vladimir Sitnikov wrote: > >Could it make sense to limit recursion to a few levels (e.g. 3 or 5) by > default, > > +1 > > Unlimited recursion is a disa

Re: StrSubstitutor recursion

Yeah, this is super cool. At work, many of our customers want DTAP configurations so we paramertize the config files for our software so we do not need four sets of configuration folders and all their files. Gary On Sun, Dec 19, 2021, 11:04 Ralph Goers wrote: > In my configuration I have > > >

Re: StrSubstitutor recursion

>Could it make sense to limit recursion to a few levels (e.g. 3 or 5) by default, +1 Unlimited recursion is a disaster waiting to happen. Adding a hard limit makes sense. Vladimir

Re: StrSubstitutor recursion

In my configuration I have ${sys:environment:-lab} ${sys:flow_match:-ACCEPT} NEUTRAL INFO INFO https://issues.apache.org/jira/browse/LOG4J2-3230 looks like it > disables recursive interpolation for strings that are not sourced from the > log4j configuration. I'm wondering why recur

Re: [VOTE] Move log4j 1.x from SVN to Git, use the current apache/log4j mirror

So it is possible, that's good to know. I was assuming that since it is currently a mirror of SVN, it couldn't be easily migrated. -Robert Middleton On Sun, Dec 19, 2021 at 2:27 AM Vladimir Sitnikov wrote: > > >I think we would > have to create a new repo and make the PR against the new repo >

Re: Zero-copy rolling files

On Sun, Dec 19, 2021 at 9:03 AM Jochen Wiedmann wrote: > > Having worked with symbolic links on Windows a lot, I find that > privileges are present, in most cases. However, there is the technical > question "How do I create them?" java.nio.file.Files.createSymbolicLink(Path, Path, FileAttribute..

Re: Log4J 1.x progress, pull request(s), plans

A hard -1 Thank you for pitching in but this PR completely breaks major blocks of functionality. I see comments like "Changed in 1.2.18+ to complain about its use and do nothing else." for the JDBC Appender, Telnet Appender, ExternallyRolledFileAppender, JMS Appender, JMX, and more! 140 files cha

Re: Zero-copy rolling files

Having worked with symbolic links on Windows a lot, I find that privileges are present, in most cases. However, there is the technical question "How do I create them?" The best solution, that I have found so far is letting "cmd" do the job for me. (The mklink command is not a separate executable,

Re: Log4J 1.x progress, pull request(s), plans

Hey folks, So as requested I've made a conservative fully binary compatible version of all the build changes and security fixes, patches are on a new pull request at https://github.com/apache/log4j/pull/17 On Sat, Dec 18, 2021 at 7:30 PM Gary Gregory wrote: > Again, you cannot break binary

StrSubstitutor recursion

Hi, The fix for https://issues.apache.org/jira/browse/LOG4J2-3230 looks like it disables recursive interpolation for strings that are not sourced from the log4j configuration. I'm wondering why recursive interpolation is desirable at all, at least as a default? Is it so you can have your config do