Re: Is a truly small core possible for 3.0?

2022-01-26 Thread Matt Sicker
On the idea of an SPI for configuration, I think that’s a great idea. There’s a bit of that which could form its own module. — Matt Sicker > On Jan 26, 2022, at 18:44, Carter Kozak wrote: > > If the API is a minimal core, that sounds like a bug! However, I don't think > that's quite the case

Re: Is a truly small core possible for 3.0?

2022-01-26 Thread Matt Sicker
The StatusLogger class needs a way to work which is via SimpleLogger. This is provided as a fallback option if no providers are found. It’s fairly basic, but you can use it for basic logging. — Matt Sicker > On Jan 26, 2022, at 18:44, Carter Kozak wrote: > > If the API is a minimal core, tha

Re: LOG4J2-3260 Missing branch protection settings

2022-01-26 Thread Carter Kozak
What if RTC only applied to the primary branch, release-2.x? We've had changes like this[1] which I discovered after the fact and wish we'd had a chance to discuss before it merged. Pushing changes prior to review is faster and easier for the committer, but ultimately creates an arduous process

Re: Is a truly small core possible for 3.0?

2022-01-26 Thread Carter Kozak
If the API is a minimal core, that sounds like a bug! However, I don't think that's quite the case, it requires that the consumer implement their own loggers entirely. What I'm thinking about is more of an spi/implementation separation akin to our loggers, but for transforming configuration byte

Re: Is a truly small core possible for 3.0?

2022-01-26 Thread Matt Sicker
A truly minimal core that only supports properties is the API itself. Look into SimpleLogger. — Matt Sicker > On Jan 26, 2022, at 18:29, Carter Kozak wrote: > > I agree with Gary about a truly minimal core (though I'm going to stay out > of the naming argument, it's one of the two hardest pr

Re: LOG4J2-3260 Missing branch protection settings

2022-01-26 Thread Gary Gregory
Not for me, this changes CTR to RTC, which is fine for work$, but too slow for me here. When I find time for FOSS, I just want to go and do it, not get bogged down in process. RTC is fine for a new medium to large feature, but not for everything. Right now, I do something in release-2.x, then cherr

Re: Is a truly small core possible for 3.0?

2022-01-26 Thread Carter Kozak
I agree with Gary about a truly minimal core (though I'm going to stay out of the naming argument, it's one of the two hardest problems in CS). My largest use-case doesn't involve parsing any sort of configuration -- it's all programmatic. I'd benefit from the ability to run without any sort of

Re: Is a truly small core possible for 3.0?

2022-01-26 Thread Matt Sicker
I'm not a fan of the properties format for the same reasons as Ralph. I think we should try to support a structured format like JSON by default as a JSON parser is fairly small to define when you don't need fancy annotation-related features. The plugins module might seem heavy, but the large numbe

Re: LOG4J2-3260 Missing branch protection settings

2022-01-26 Thread Matt Sicker
I'd be on board with this. It might be worth having some rule that if a committer's PR goes unreviewed for over a certain period of time, then the committer can just merge the PR after it passes the automated checks. I don't want this project's development to end up stalled because everyone is eith

Re: LOG4J2-3260 Missing branch protection settings

2022-01-26 Thread Carter Kozak
I'd love to start using the github PR workflow for our contributions. I've been using them for my changes for a while and find it much easier than running a full build locally to verify each change on my development system. While we've historically used "commit then review", I find it much easier

LOG4J2-3260 Missing branch protection settings

2022-01-26 Thread Volkan Yazıcı
According to the OSSF Scorecards , we are missing two check marks (LOG4J2-3260 ) there: 1. Require code review (every change goes into a PR and requires at least one reviewer) 2. Require a CI status chec

Re: [apache/logging-log4j2] Bump tomcat-catalina from 8.5.20 to 10.0.14 (PR #662)

2022-01-26 Thread Volkan Yazıcı
Mind somebody reviewing the following PR, please? https://github.com/apache/logging-log4j2/pull/730 Time, what do you think? On Mon, Jan 24, 2022 at 10:21 PM Tim Perry wrote: > Sorry Volkan, I think I somehow searched the wrong pom.xml. I was convinced > appserver was bringing in log4j-jms, but

Re: Is a truly small core possible for 3.0?

2022-01-26 Thread Ralph Goers
Gary, Let’s start with the easiest first. You have always been more concerned with naming than I have. Whether you call it impl, core, or base would make no difference to me except I see no compelling reason to impact users by changing the name of the dependency. It is one thing to rename varia

Is a truly small core possible for 3.0?

2022-01-26 Thread Gary Gregory
Hi all, Is a truly small core possible for 3.0? What I mean by that is that I'd like to run an app with log4j without an XML configuration, or JSON, or YAML, or the whole plugin infrastructure, scanning, or reading a plugin metadata db. Just a properties files. And if I can only run with just a p