Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Ceki Gülcü
On 07/01/2022 01:53, Matt Sicker wrote: > If you had left a comment back when we voted on the EOL status > recently, then perhaps things would be different. Waiting until > right after the second EOL announcement makes us seem like we > just lied about said EOL status. On 07/01/2022 02:46, Ma

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Matt Sicker
I should also note that naming a fork “relog4j” is confusingly similar to “log4j”. Please don’t infringe the trademark. -- Matt Sicker > On Jan 6, 2022, at 18:18, Ceki Gülcü wrote: > > > > Hello all, > > Given the recent refusal to even consider work on a 1.2.18 branch, which > would have b

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Matt Sicker
If you had left a comment back when we voted on the EOL status recently, then perhaps things would be different. Waiting until right after the second EOL announcement makes us seem like we just lied about said EOL status. — Matt Sicker > On Jan 6, 2022, at 18:18, Ceki Gülcü wrote: > >  > >

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Ceki Gülcü
Hello all, Given the recent refusal to even consider work on a 1.2.18 branch, which would have been subject to PMC vote before release anyway, I have created a separate repository on github under the name "relog4j1". The intent of relog4j1 is to fix existing critical issues in log4j 1.x.

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Ceki Gülcü
On 07/01/2022 00:05, Ralph Goers wrote: Unless you can convince Gary to rescind his veto there is no choice but to revert. Reverted in github. -- Ceki Gülcü

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Tim Perry
Maybe I'm missing something, but shouldn't it be 1.2.18? There was already a log4j release 1.2.8 in 2005. On Thu, Jan 6, 2022 at 2:54 PM Matt Sicker wrote: > Plus, the branch name sounds like a tag. > > On Thu, Jan 6, 2022 at 3:21 PM Gary Gregory > wrote: > > > > -1 This component reached End-o

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Ralph Goers
v1.2.8? Odd choice to work on 1.2.18. However, with Gary expressing a -1 (a veto) by ASF rules the problem specified (12 being EOL) would either need to be resolved or the commit reverted. Unless you can convince Gary to rescind his veto there is no choice but to revert. Ralph > On Jan 6, 2

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Matt Sicker
Plus, the branch name sounds like a tag. On Thu, Jan 6, 2022 at 3:21 PM Gary Gregory wrote: > > -1 This component reached End-of-Life in 2015. > > Gary > > On Thu, Jan 6, 2022 at 12:46 PM wrote: > > > This is an automated email from the ASF dual-hosted git repository. > > > > ceki pushed a chang

Re: [logging-log4j1] branch v1.2.8 created (now 0cde9dd)

2022-01-06 Thread Gary Gregory
-1 This component reached End-of-Life in 2015. Gary On Thu, Jan 6, 2022 at 12:46 PM wrote: > This is an automated email from the ASF dual-hosted git repository. > > ceki pushed a change to branch v1.2.8 > in repository https://gitbox.apache.org/repos/asf/logging-log4j1.git. > > > at 0cde9

RE: [LOG4J 1] standardizing the Maven build

2022-01-06 Thread Jason Pyeron
> -Original Message- > From: Matt Sicker > Sent: Thursday, January 6, 2022 2:51 PM > > I agree with Ralph here. Feel free to organize things to make a full > release possible. If I can't build and run a release candidate from > source, then I'll have trouble verifying and voting on a rele

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Matt Sicker
I think it would be great to hear what the expected changes are to be made here. It still seems like a huge amount of work that nobody cared about until we published a CVE for v2 which was only applicable to v2 (something I tend not to see in smaller projects who rarely if ever bother filing CVEs w

Re: [LOG4J 1] standardizing the Maven build

2022-01-06 Thread Matt Sicker
I agree with Ralph here. Feel free to organize things to make a full release possible. If I can't build and run a release candidate from source, then I'll have trouble verifying and voting on a release down the line. On Thu, Jan 6, 2022 at 1:21 PM Ralph Goers wrote: > > Leo, > > Maybe, but maybe

Re: [LOG4J 1] standardizing the Maven build

2022-01-06 Thread Ralph Goers
Leo, Maybe, but maybe not. To be clear, the PMC still has concerns about this. But Ceki has commit rights and obviously has quite a bit of knowledge on Log4j and what was supported. My personal opinion is that the closer the build can get to producing a release that is 100% compatible with Log

Re: [LOG4J 1] standardizing the Maven build

2022-01-06 Thread Ceki Gülcü
Hi Leo, Don't you think standardizing to usual Maven folder structure would save everyone a log of time down the line? --Ceki On 06/01/2022 20:07, Leo Simons wrote: Hey Ceki, Builds and tests were already fixed up, see the most recent outstanding PRs. Might be faster to cherry-pick rather

Re: [LOG4J 1] standardizing the Maven build

2022-01-06 Thread Leo Simons
Hey Ceki, Builds and tests were already fixed up, see the most recent outstanding PRs. Might be faster to cherry-pick rather than to re-do; if you start to move things around you’ll have a hard time merging anything in. Cheers, Leo On Thu, 6 Jan 2022 at 19:39, Ceki Gülcü wrote: > > Hello all,

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Christian Grobmeier
Hi On Thu, Jan 6, 2022, at 15:05, Ceki Gülcü wrote: > On 06/01/2022 14:42, Christian Grobmeier wrote: >> Which ones? The JMSAppender issue or the SockerServer issue? Both have been >> there >2012. What is suddenly so critical it requires re-releasing EOL >> software? Or did you mean the multith

[LOG4J 1] standardizing the Maven build

2022-01-06 Thread Ceki Gülcü
Hello all, I have created the v1.2.8 branch under logging-log4j1.git [1]. I Will proceed to move tests under the standard Maven location and have them pass under surefire (without ant). This might take a while but should be feasible. [1] https://gitbox.apache.org/repos/asf/logging-log4j1.g

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ceki Gülcü
On 06/01/2022 15:17, Ralph Goers wrote: Our repos aren’t open to any ASF committer, only Logging Services committers. We have very few committers who are also not PMC members. So you would likely be the only person with commit rights who might be interested in doing the work required to do

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ralph Goers
> On Jan 6, 2022, at 7:05 AM, Ceki Gülcü wrote: > > > > On 06/01/2022 14:42, Christian Grobmeier wrote: >> Which ones? The JMSAppender issue or the SockerServer issue? Both have been >> there >2012. What is suddenly so critical it requires re-releasing EOL >> software? Or did you mean the

Re: Master branch

2022-01-06 Thread Ralph Goers
Gary, To be clear, you are proposing that we create the same log4j-api-test and log4j-core-test modules that exist in master? If you want to do that work I won’t object. But I myself would prefer to focus on master at this point as much as possible so we can get 3.0 out in a reasonable time f

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ceki Gülcü
On 06/01/2022 14:42, Christian Grobmeier wrote: Which ones? The JMSAppender issue or the SockerServer issue? Both have been there >2012. What is suddenly so critical it requires re-releasing EOL software? Or did you mean the multithreading issues? Certain things have changed during the mo

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ralph Goers
Ceki, Thank you for posting this. Your input here is always welcome so far as I am concerned. This is a much better place to hold discussions than Twitter. See below. > On Jan 6, 2022, at 3:00 AM, Ceki Gülcü wrote: > > > Dear Ron, > > Thank you for this detailed and very well crafted messa

Re: Master branch

2022-01-06 Thread Gary Gregory
On Mon, Jan 3, 2022 at 7:30 AM Volkan Yazıcı wrote: > Fantastic work Ralph! Please see my comments below: > > On Tue, Dec 28, 2021 at 9:39 AM Ralph Goers > wrote: > > Most of the components that were generating test jars have been split > into two modules - the main component, > > which only bui

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Christian Grobmeier
Hello Ceki On Thu, Jan 6, 2022, at 11:00, Ceki Gülcü wrote: > The fact that the decision was unanimous on such a delicate matter is > quite surprising and very interesting in itself with respect to group > dynamics. You haven't been at the meeting. That's why you don't know anything about this

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ceki Gülcü
Dear Ron, Thank you for this detailed and very well crafted message. I would like to make the following observations. The fact that the decision was unanimous on such a delicate matter is quite surprising and very interesting in itself with respect to group dynamics. Coming back to the i