I know Vladimir but let's do things in order, if we move in all ways it will fail. Incubating log4j1 will fail as I epxlained - not even sure incubator would let it be incubated since project is official dead for everybody and can only get security fixes (incubator is to ensure you can build a community and comply to ASF, for log4j1 it is out of topic). If current logging PMC does not want to release they will have the choice to donate the group for an external project or let the release be done. For that last point you need at least 3 PMC voting and if current one does not want to do it they can always add new PMC member willing to release - plenty are easily found, even just in this thread.
So please stick to the normal plan: 1. do the work 2. share it properly (one feature per patch/ticket, not all at once is what I mean here ;)) 3. solve the "how to release" To be honest speaking of 3 without having 1 and 2 is pointless. Just to push what I just said: we had the same in maven (surefire) and the release had been done finally so back to keyboard if anyone wants it to happen IMHO, no need to look for future issues before they are actually actual. Romain Le mer. 22 déc. 2021 à 08:42, Vladimir Sitnikov <sitnikov.vladi...@gmail.com> a écrit : > Romain, > > Romain>for now the thread is looking for options which are not needed from > my window > > It was the Logging PMC team who suggested I should re-incubate log4j 1.x. > > Romain>1. where is the patch needed to fix the desired CVE? - must be > compatible > with current SVN trunk > > The current SVN trunk is NOT buildable. > It uses outdated build tools, so build system healing > is needed before ANY other patches. > > Romain>2. please attach it to a ticket > > I have just created https://issues.apache.org/jira/browse/LOG4J2-3272 > "Enable Git and GitHub for log4j 1.2 repository" > > Every patch to 1.x must be well-tested, so attaching patch files to JIRA > is a recipe for disaster. > > I already asked Logging PMC to enable Git and GitHub for 1.x, and they > rejected it: > https://lists.apache.org/thread/ssbdg44gy7txzl16xxd097t7orco52g2 > > I do not see why filing the same thing as JIRA would work any better than > sending mail to dev@logging list. > > Vladimir >
