Hi All, I tried to adapt the review kit to my setup, running:
sh mvn verify -P docker \ -Prelease artifact:compare \ -Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1325 I get: ... [INFO] --- artifact:3.6.0:compare (default-cli) @ log4j-bom --- [INFO] <project.build.outputTimestamp> property (= 2026-05-02T19:54:56Z) is inherited, you can override in pom.xml Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1325/org/apache/logging/log4j/log4j-bom/2.26.0/log4j-bom-2.26.0.buildinfo [INFO] Reference buildinfo file not found: it will be generated from downloaded reference artifacts Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1325/org/apache/logging/log4j/log4j-bom/2.26.0/log4j-bom-2.26.0.pom Downloaded from reference: https://repository.apache.org/content/repositories/orgapachelogging-1325/org/apache/logging/log4j/log4j-bom/2.26.0/log4j-bom-2.26.0.pom (12 kB at 78 kB/s) Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1325/org/apache/logging/log4j/log4j-bom/2.26.0/log4j-bom-2.26.0-cyclonedx.xml Downloaded from reference: https://repository.apache.org/content/repositories/orgapachelogging-1325/org/apache/logging/log4j/log4j-bom/2.26.0/log4j-bom-2.26.0-cyclonedx.xml (435 kB at 600 kB/s) [INFO] Minimal buildinfo generated from downloaded artifacts: /Users/garygregory/rc/log4j-2.26.0/src/target/reference/log4j-bom-2.26.0.buildinfo [ERROR] sha512 mismatch log4j-bom-2.26.0-cyclonedx.xml: investigate with diffoscope target/reference/org.apache.logging.log4j/log4j-bom-2.26.0-cyclonedx.xml target/bom.xml [ERROR] Reproducible Build output summary: 1 files ok, 1 different [ERROR] see diff target/reference/log4j-bom-2.26.0.buildinfo target/log4j-bom-2.26.0.buildinfo [ERROR] see also https://maven.apache.org/guides/mini/guide-reproducible-builds.html [INFO] Reproducible Build output comparison saved to /Users/garygregory/rc/log4j-2.26.0/src/target/log4j-bom-2.26.0.buildcompare [INFO] Aggregate buildcompare copied to /Users/garygregory/rc/log4j-2.26.0/src/target/log4j-bom-2.26.0.buildcompare [INFO] ------------------------------------------------------------------------ ... diff target/reference/log4j-bom-2.26.0.buildinfo target/log4j-bom-2.26.0.buildinfo 0a1,2 > # https://reproducible-builds.org/docs/jvm/ > buildinfo.version=1.0-SNAPSHOT 1a4,25 > name=Apache Log4j BOM > group-id=org.apache.logging.log4j > artifact-id=log4j-bom > version=2.26.0 > > # source information > source.scm.uri=scm:git:https://github.com/apache/logging-log4j2.git > source.scm.tag=rel/2.25.3 > > # build instructions > build-tool=mvn > > # effective build environment information > java.version=17.0.19 > java.vendor=Homebrew > os.name=Mac OS X > > # Maven rebuild instructions and effective environment > mvn.version=3.9.15 > > # output > 10c34 < outputs.1.checksums.sha512=b421514aae72c62eaa47db2d4954b7a3f1d19416bbc8642d6914b5e06ed30f293f5a0557b1d8bc1e4f32578a47c2af38f60fbb5174dfbeb025afb9007cab292b --- > outputs.1.checksums.sha512=2b2968ac73a5ac4fb38b4dce56ebbb61d044c082beae0053015561d35142b9621799b100efc1a384825fc68f87be1d3ecee675da492a1500fc0adfdf3a39bd48 My set up: openjdk version "17.0.19" 2026-04-21 OpenJDK Runtime Environment Homebrew (build 17.0.19+0) OpenJDK 64-Bit Server VM Homebrew (build 17.0.19+0, mixed mode, sharing) Apache Maven 3.9.15 (98b2cdbfdb5f1ac8781f537ea9acccaed7922349) Maven home: /opt/homebrew/Cellar/maven/3.9.15/libexec Java version: 17.0.19, vendor: Homebrew, runtime: /opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home Default locale: en_US, platform encoding: UTF-8 OS name: "mac os x", version: "26.4.1", arch: "aarch64", family: "mac" Darwin ****.local 25.4.0 Darwin Kernel Version 25.4.0: Thu Mar 19 19:33:25 PDT 2026; root:xnu-12377.101.15~1/RELEASE_ARM64_T6041 arm64 Docker version 29.4.1, build 055a478 Gary On Mon, May 4, 2026 at 3:47 AM Volkan Yazıcı <[email protected]> wrote: > > This is a vote to release the Apache Log4j `2.26.0`. > > Website: https://logging.staged.apache.org/log4j/2.26.0 > GitHub: https://github.com/apache/logging-log4j2 > Commit: c1ad2a66cc90e643ec319b9e131764c9710bebc5 > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j/2.26.0 > Nexus: > https://repository.apache.org:443/content/repositories/orgapachelogging-1325 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > Review kit: > https://logging.apache.org/logging-parent/release-review-instructions.html > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... > > This vote is open for 72 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > == Release Notes > > This minor release delivers all the fixes in the `[2.25.0, 2.25.4]` > version range, plus some new fixes, and several other > improvements and features. > > === Added > > * Add a new `ConfigurationFactory::getConfiguration` method > accepting multiple `URI`s (#3775, #3921) > * Add and export > `org.apache.logging.log4j.core.pattern.NamedInstantPattern` > enabling users to programmatically access named date > & time patterns supported by Pattern Layout (#3789) > * Add `log4j.plugin.processor.minAllowedMessageKind` > annotation processor option to `PluginProcessor` to filter > diagnostic messages by severity. This allows builds that > treat compiler notes as errors (e.g. Maven with `-Werror`) > to suppress informational notes emitted during normal > plugin processing. (#3380, #4063) > * Add missing setters to `Rfc5424LayoutBuilder` > > === Changed > > * Ensure scripts in the global `Scripts` element have > explicit names by throwing a `ConfigurationException` > for unnamed ones. (#3176) > * Simplify file manager registry factory methods (#3968) > > === Deprecated > > * Deprecated withers in builder classes in favor of setters. > This change improves API consistency with Log4j Core > 3 and helps users adapt to the upcoming changes. (#3750) > > === Fixed > > * Fix script resolution failure when the `Scripts` element > is placed after a `ScriptRef` in the configuration. (#3336) > * Fix `ArrayIndexOutOfBoundsException` thrown by > `ThrowableStackTraceRenderer` when the stack trace > is modified concurrently (#3940, #3955) > * Fix `SLF4JLogger.atFatal()` returning `atLevel(Level.TRACE)` > instead of `atLevel(Level.FATAL)`. This was causing > `FATAL`-level log events to be silently discarded when using > the fluent API through the `log4j-to-slf4j` bridge. (#4068, #4089) > * Fix Javadoc references across module boundaries > (i.e., cross-references) (#4099, #4100) > * Fix header write in `RollingRandomAccessFileManager` that > was being incorrectly skipped if `append=true` and the file > didn't exist before > * Fix a properties file configuration regression caused by not > referenced loggers, appenders, and filters (#4036, #4069) > > === Removed > > * Remove the `jvmrunargs` lookup. (#3874) > > === Updated > > * Update `org.junit:junit-bom` to version `5.13.4` (#3850) > * Update `org.mongodb:bson` to version `5.6.1` (#3961) > * Update `org.xerial.snappy:snappy-java` to version `1.1.10.8` (#3841)
