ramanathan1504 commented on issue #4007: URL: https://github.com/apache/logging-log4j2/issues/4007#issuecomment-4954712155
### **Final Verification Report for #4007** @vy @ppkarwasz, I have completed a strict verification of this issue on an M2 Mac using a multi-stage Docker environment. ### **Root Cause Identified** 1. **Stale Inheritance:** Log4j 2.26.0 was released using `logging-parent:11.3.0`, which provided Bnd annotation **7.1.0** (Java 17 bytecode). The current `2.x` branch uses `logging-parent:12.1.1`, which still resolves to **7.1.0**. 2. **The Local Blocker:** Even after `logging-parent` is updated, the **`log4j-parent/pom.xml`** in this repository contains a **hardcoded property override** at Line 84: `<bnd.annotation.version>7.1.0</bnd.annotation.version>`. 3. **Metadata Leak:** This hardcoded 7.1.0 version is exported into the **Gradle Module Metadata**, forcing Gradle users on JDK 8/11 to download the Java 17-compiled JAR. ### **A/B Verification Results** * **Test A (Released 2.26.0):** **FAILED** on JDK 8. Error: `class file has wrong version 61.0, should be 52.0`. * **Test B (2.x branch + Fix):** **PASSED** on JDK 8. Reproduction project compiled successfully with `-Xlint:classfile -Werror`. ### **Verification Dockerfile** Maintainers can use the following Dockerfile to reproduce the failure and verify the fix. It builds Log4j using JDK 17 (as required) and verifies it using **JDK 8**. ```dockerfile # STAGE 1: Build Log4j 2.x with the fix using JDK 17 FROM eclipse-temurin:17-jdk AS builder WORKDIR /src RUN apt-get update && apt-get install -y git sed # 1. Clone the current 2.x branch RUN git clone --depth 1 --branch 2.x https://github.com/apache/logging-log4j2.git . # 2. APPLY THE FIX: Update Bnd annotation version to 7.2.3 in log4j-parent # This overrides the stale version from the parent and the hardcoded metadata config. RUN sed -i 's/<bnd.annotation.version>7.1.0<\/bnd.annotation.version>/<bnd.annotation.version>7.2.3<\/bnd.annotation.version>/g' log4j-parent/pom.xml # 3. Build the core API (produces JAR and .module metadata) RUN ./mvnw install -DskipTests -pl log4j-api-java9,log4j-api -am # STAGE 2: Verify compatibility using JDK 8 FROM eclipse-temurin:8-jdk WORKDIR /verify COPY --from=builder /root/.m2/repository /root/.m2/repository # 4. Create a minimal reproduction class RUN echo "import org.apache.logging.log4j.util.PropertiesUtil; \ public class Repro { \ public static void main(String[] args) { \ PropertiesUtil.getProperties(); \ System.out.println(\"SUCCESS: JDK 8 can now read Log4j metadata.\"); \ } \ }" > Repro.java # 5. VERIFICATION: This command fails if 7.1.0 is used and passes with 7.2.3 RUN javac -cp "/root/.m2/repository/org/apache/logging/log4j/log4j-api/2.27.0-SNAPSHOT/log4j-api-2.27.0-SNAPSHOT.jar" \ -Xlint:classfile -Werror Repro.java CMD ["echo", "Verification Complete: Log4j 2.x with Bnd 7.2.3 is compatible with JDK 8."] ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
