Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Ralph Goers]

OK, thanks for the clarification. I do have a strong opinion. Infra made it 
clear that rel/ is for tagging releases. Release candidates are NOT releases. 
Furthermore, if you find a problem before starting a vote it is very easy to 
just delete a non-rel/ tag and rerun the candidate. Once the vote starts the 
tag should not be deleted but it is otherwise very confusing to have a vote on 
rel/1.0-rc1 followed by a vote on rel/1.0-rc3 or rc4. What happened to the 
missing candidates? It just creates needless permanent tags in the repo and 
gets annoying for users who are looking for just the “real” release tags.  

Release candidates should ALWAYS use a tag that is completely separate from the 
release tags for the above reasons.  To be honest, I might consider voting -1 
on future releases that don’t do that.

Ralph

> On May 4, 2023, at 1:48 PM, Piotr P. Karwasz  wrote:
> 
> Hi Ralph,
> 
> On Thu, 4 May 2023 at 22:35, Ralph Goers  wrote:
>> 
>> That makes me question what is in the actual release.  Tags named “rel/“ are 
>> immutable so you can’t have added anything to that after the first rc.
> 
> It took me a while to get the automatic release scripts going. So there was:
> 
> * rel/0.1.0.rc1 (with a dot): first attempt with
> `maven-release-plugin`, which pushed the tag,
> * rel/0.1.0-rc2: second release candidate, first deployed by Github
> Actions, the tag is mine,
> * rel/0.1.0-rc1 (as in the vote e-mail): third release candidate,
> deployed by Github Actions, the tag was also pushed by GA. In an
> effort to order things up I manually pushed `rel/0.1.0-rc3`.
> 
> Sorry for the confusion. I guess the tagging policy will be a hot
> topic of the next meeting. Personally I don't have a strong opinion in
> this regard, I just copied what `l-l-tools` does.
> 
> Piotr

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Piotr P. Karwasz]

Hi Ralph,

On Thu, 4 May 2023 at 22:35, Ralph Goers  wrote:
>
> That makes me question what is in the actual release.  Tags named “rel/“ are 
> immutable so you can’t have added anything to that after the first rc.

It took me a while to get the automatic release scripts going. So there was:

 * rel/0.1.0.rc1 (with a dot): first attempt with
`maven-release-plugin`, which pushed the tag,
 * rel/0.1.0-rc2: second release candidate, first deployed by Github
Actions, the tag is mine,
 * rel/0.1.0-rc1 (as in the vote e-mail): third release candidate,
deployed by Github Actions, the tag was also pushed by GA. In an
effort to order things up I manually pushed `rel/0.1.0-rc3`.

Sorry for the confusion. I guess the tagging policy will be a hot
topic of the next meeting. Personally I don't have a strong opinion in
this regard, I just copied what `l-l-tools` does.

Piotr

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Ralph Goers]

That makes me question what is in the actual release.  Tags named “rel/“ are 
immutable so you can’t have added anything to that after the first rc.

Ralph

> On May 4, 2023, at 1:31 PM, Piotr P. Karwasz  wrote:
> 
> Hi Matt,
> 
> On Thu, 4 May 2023 at 22:09, Matt Sicker  wrote:
>> 
>> Which tag is it? I see ‘rel/0.1.0-rc1’ and then references to RC2 and RC3?
> 
> It's `rel/0.1.0-rc1` due to a bug in the CI scripts. I added
> `rel/0.1.0-rc3` right now to partially correct it.
> 
> Piotr

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Ralph Goers]

The vote email says Tag: rel/0.1.0-rc1.  That can’t be correct.

Ralph

> On May 4, 2023, at 1:10 PM, Matt Sicker  wrote:
> 
> And no tag containing the term “rc3” in git, either.
> 
>> On May 4, 2023, at 3:09 PM, Matt Sicker  wrote:
>> 
>> Which tag is it? I see ‘rel/0.1.0-rc1’ and then references to RC2 and RC3?
>> 
>>> On May 2, 2023, at 2:08 PM, Piotr P. Karwasz  
>>> wrote:
>>> 
>>> The Apache Log4j Transformation Tools 0.1.0 release is now available for 
>>> voting.
>>> 
>>> This is the first release and it contains two modules:
>>> 
>>> * [LOG4J2-3638]: Adds a bytecode transformation tool to provide
>>> location information without reflection.
>>> * [LOG4J2-673]: Adds a resource transformer for the Maven Shade Plugin
>>> to merge `Log4j2Plugins.dat` plugin caches. Thanks to Eduard
>>> Gizatullin.
>>> 
>>> Changes between RC2 and RC3:
>>> 
>>> * The `log4j-transform-maven-plugin` has a `includes/excludes` setting
>>> now (useful for benchmark testing),
>>> * There is a `log4j-transform-perf` module (not in the main reactor
>>> for a chicken and egg problem),
>>> * The release was fully automated (hence the 0.1.0-rc1 tag instead of
>>> 0.1.0-rc3 tag due to some differences between my bash and Github),
>>> * The source archive does not have Git and Github-related stuff (thanks 
>>> Gary).
>>> 
>>> Source repository: https://github.com/apache/logging-log4j-transform
>>> Tag: rel/0.1.0-rc1
>>> Commit: b49a898f74e1ceaa8cd883f211c0a9c30ef8f5c1
>>> Artifacts: 
>>> https://dist.apache.org/repos/dist/dev/logging/log4j-transform/0.1.0
>>> Nexus repository:
>>> https://repository.apache.org/content/repositories/orgapachelogging-1106
>>> CI job run: 
>>> https://github.com/apache/logging-log4j-transform/actions/runs/4864531191
>>> Signing key: 
>>> https://keyserver.ubuntu.com/pks/lookup?search=077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0&fingerprint=on&op=index
>>> Website: https://logging.staged.apache.org/log4j/2.x/log4j-transform
>>> 
>>> Please download, test, and cast your votes on the Log4j developers list.
>>> 
>>> [ ] +1, release the artifacts
>>> [ ] -1, don't release, because...
>>> 
>>> The vote will remain open for 72 hours All votes are welcome and we
>>> encourage everyone to test the release, but only the Logging Services
>>> PMC votes are officially counted. At least 3 +1 votes and more
>>> positive than negative votes are required.
>>> 
>>> Countdown: 
>>> https://www.timeanddate.com/countdown/launch?iso=20230505T2115&p0=4162&msg=Log4j+Transformation+Tools+0.1.0&font=cursive
>> 
> 

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Piotr P. Karwasz]

Hi Matt,

On Thu, 4 May 2023 at 22:09, Matt Sicker  wrote:
>
> Which tag is it? I see ‘rel/0.1.0-rc1’ and then references to RC2 and RC3?

It's `rel/0.1.0-rc1` due to a bug in the CI scripts. I added
`rel/0.1.0-rc3` right now to partially correct it.

Piotr

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Matt Sicker]

And no tag containing the term “rc3” in git, either.

> On May 4, 2023, at 3:09 PM, Matt Sicker  wrote:
> 
> Which tag is it? I see ‘rel/0.1.0-rc1’ and then references to RC2 and RC3?
> 
>> On May 2, 2023, at 2:08 PM, Piotr P. Karwasz  wrote:
>> 
>> The Apache Log4j Transformation Tools 0.1.0 release is now available for 
>> voting.
>> 
>> This is the first release and it contains two modules:
>> 
>> * [LOG4J2-3638]: Adds a bytecode transformation tool to provide
>> location information without reflection.
>> * [LOG4J2-673]: Adds a resource transformer for the Maven Shade Plugin
>> to merge `Log4j2Plugins.dat` plugin caches. Thanks to Eduard
>> Gizatullin.
>> 
>> Changes between RC2 and RC3:
>> 
>> * The `log4j-transform-maven-plugin` has a `includes/excludes` setting
>> now (useful for benchmark testing),
>> * There is a `log4j-transform-perf` module (not in the main reactor
>> for a chicken and egg problem),
>> * The release was fully automated (hence the 0.1.0-rc1 tag instead of
>> 0.1.0-rc3 tag due to some differences between my bash and Github),
>> * The source archive does not have Git and Github-related stuff (thanks 
>> Gary).
>> 
>> Source repository: https://github.com/apache/logging-log4j-transform
>> Tag: rel/0.1.0-rc1
>> Commit: b49a898f74e1ceaa8cd883f211c0a9c30ef8f5c1
>> Artifacts: 
>> https://dist.apache.org/repos/dist/dev/logging/log4j-transform/0.1.0
>> Nexus repository:
>> https://repository.apache.org/content/repositories/orgapachelogging-1106
>> CI job run: 
>> https://github.com/apache/logging-log4j-transform/actions/runs/4864531191
>> Signing key: 
>> https://keyserver.ubuntu.com/pks/lookup?search=077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0&fingerprint=on&op=index
>> Website: https://logging.staged.apache.org/log4j/2.x/log4j-transform
>> 
>> Please download, test, and cast your votes on the Log4j developers list.
>> 
>> [ ] +1, release the artifacts
>> [ ] -1, don't release, because...
>> 
>> The vote will remain open for 72 hours All votes are welcome and we
>> encourage everyone to test the release, but only the Logging Services
>> PMC votes are officially counted. At least 3 +1 votes and more
>> positive than negative votes are required.
>> 
>> Countdown: 
>> https://www.timeanddate.com/countdown/launch?iso=20230505T2115&p0=4162&msg=Log4j+Transformation+Tools+0.1.0&font=cursive
> 

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Matt Sicker]

Which tag is it? I see ‘rel/0.1.0-rc1’ and then references to RC2 and RC3?

> On May 2, 2023, at 2:08 PM, Piotr P. Karwasz  wrote:
> 
> The Apache Log4j Transformation Tools 0.1.0 release is now available for 
> voting.
> 
> This is the first release and it contains two modules:
> 
> * [LOG4J2-3638]: Adds a bytecode transformation tool to provide
> location information without reflection.
> * [LOG4J2-673]: Adds a resource transformer for the Maven Shade Plugin
> to merge `Log4j2Plugins.dat` plugin caches. Thanks to Eduard
> Gizatullin.
> 
> Changes between RC2 and RC3:
> 
> * The `log4j-transform-maven-plugin` has a `includes/excludes` setting
> now (useful for benchmark testing),
> * There is a `log4j-transform-perf` module (not in the main reactor
> for a chicken and egg problem),
> * The release was fully automated (hence the 0.1.0-rc1 tag instead of
> 0.1.0-rc3 tag due to some differences between my bash and Github),
> * The source archive does not have Git and Github-related stuff (thanks Gary).
> 
> Source repository: https://github.com/apache/logging-log4j-transform
> Tag: rel/0.1.0-rc1
> Commit: b49a898f74e1ceaa8cd883f211c0a9c30ef8f5c1
> Artifacts: 
> https://dist.apache.org/repos/dist/dev/logging/log4j-transform/0.1.0
> Nexus repository:
> https://repository.apache.org/content/repositories/orgapachelogging-1106
> CI job run: 
> https://github.com/apache/logging-log4j-transform/actions/runs/4864531191
> Signing key: 
> https://keyserver.ubuntu.com/pks/lookup?search=077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0&fingerprint=on&op=index
> Website: https://logging.staged.apache.org/log4j/2.x/log4j-transform
> 
> Please download, test, and cast your votes on the Log4j developers list.
> 
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
> 
> The vote will remain open for 72 hours All votes are welcome and we
> encourage everyone to test the release, but only the Logging Services
> PMC votes are officially counted. At least 3 +1 votes and more
> positive than negative votes are required.
> 
> Countdown: 
> https://www.timeanddate.com/countdown/launch?iso=20230505T2115&p0=4162&msg=Log4j+Transformation+Tools+0.1.0&font=cursive

log4j vulnerability MS SQL Server 2017 / 2019

[Sawant, Pritesh]

Hi Team,

We have facing some log4j related vulnerability on our windows host for MS SQL 
Server 2017 / 2019.

I have check so many articles, but in that I have not found any proper solution 
for resolving that issue.

We want some solution for updating the version of log4j to log4j 2.16 + or if 
it's not possible for windows host then what is the next approach for that ?

Regards,
Pritesh Sawant
Software Engineer
Ingram Micro India SSC Private. Limited
G-2, Akruti Corporate Park,
Kanjurmarg West.
Email : pritesh.saw...@ingrammicro.com
Phone No. : +91 7208817149
[cid:image001.png@01D97ED3.DEF1AD40]



This e-mail is for the use of the intended recipient(s) only. If you have 
received in error, please notify the sender immediately and delete it. If you 
are not the intended recipient, you must not use, disclose or distribute this 
e-mail without the author prior   permission. Ingram Micro checks outgoing mail 
and accepts no liability for any loss or damage caused by software viruses.

[Ingram_2818e5de]

Re: [VOTE] Release log4cxx 1.1.0-RC2

[Thorsten Schöning]

Guten Tag Robert Middleton,
am Mittwoch, 3. Mai 2023 um 12:38 schrieben Sie:

> Please download, test, and cast your votes on the log4j developers list.
> [] +1, release the artifacts
> [] -1, don't release because...

+1

I've successfully compiled and ran tests using MS Visual Studio 2022
(17.5.5) 64 Bit under Windows 10 22H2 19045.2846 64 Bit.

Mit freundlichen Grüßen

Thorsten Schöning

-- 
AM-SoFT IT-Service - Bitstore Hameln GmbH
Mitglied der Bitstore Gruppe - Ihr Full-Service-Dienstleister für IT und TK

E-Mail: thorsten.schoen...@am-soft.de
Web:http://www.AM-SoFT.de/

Tel:   +49 5151-  9468- 0
Tel:   +49 5151-  9468-55
Mobil: +49  178-8 9468-04

AM-SoFT IT-Service - Bitstore Hameln GmbH, Brandenburger Str. 7c, 31789 Hameln
AG Hannover HRB 221853 - Geschäftsführer: Janine Galonska


Für Rückfragen stehe ich Ihnen jederzeit zur Verfügung. 

Mit freundlichen Grüßen, 

Thorsten Schöning


Telefon: +49 5151 9468-55
Fax: 
E-Mail: tschoen...@am-soft.de

AM-Soft IT-Service - Bitstore Hameln GmbH
Brandenburger Straße 7c
31789 Hameln

Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen 
und ist ausschliesslich für den Adressaten bestimmt. Jeglicher Zugriff auf 
diese E-Mail durch andere Personen als den Adressaten ist untersagt. Wenn Sie 
nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, 
informieren Sie bitte sofort den Absender und vernichten Sie diese E-Mail. 
Sollten Sie nicht der für diese E-Mail bestimmte Adressat sein, ist Ihnen jede 
Veröffentlichung, Vervielfältigung oder Weitergabe wie auch das Ergreifen oder 
Unterlassen von Massnahmen im Vertrauen auf erlangte Information untersagt. 

This e-mail may contain confidential and/or privileged information and is 
intended solely for the addressee. Access to this email by anyone else is 
unauthorized. If you are not the intended recipient (or have received this 
e-mail in error) please notify the sender immediately and destroy this e-mail. 
If you are not the intended recipient, any disclosure, copying, distribution or 
any action taken or omitted to be taken in reliance on it, is prohibited and 
may be unlawful. 

Hinweise zum Datenschutz: bitstore.group/datenschutz

Re: Discuss [VOTE] Release Apache Log4j Transformation Tools 0.1.0

[Gary Gregory]

I'm not willing to do anything on any hill here either and I'd rather
gel with the team consensus, I've said my bits ;-)

Gary

On Tue, May 2, 2023 at 4:10 PM Volkan Yazıcı  wrote:
>
> Email archives are irrelevant for the provenance of sources; an arbitrary
> tag/commit not sealed with `rel/` prefix might disappear and we will lose
> the context to "what was proposed/rejected for release" .
>
> We don't have hundreds of releases with dozens of RCs for each. I would
> rather see my `git tag -l` neatly output
>
> rel/0.1.0
> rel/0.1.0-rc1
> rel/0.2.0
> rel/0.2.0-rc1
> rel/0.3.0
> rel/0.3.0-rc1
>
> rather than
>
> rel/0.1.0
> rel/0.2.0
> rel/0.3.0
> prefix-for-tag-nobody-cares-0.1.0-rc1
> prefix-for-tag-nobody-cares-0.2.0-rc1
> prefix-for-tag-nobody-cares-0.3.0-rc1
>
> RCs are subject to provenance, IMO.
> Wanted to share my 2 cents.
> This is not a mountain I am willing to die on.
>
> On Tue, May 2, 2023 at 9:40 PM Gary Gregory  wrote:
>
> > What you are proposing IMO is confusing and clutters up the release tag
> > space: "rel" stands for "releases", not for "candidates for releases that
> > may be completely broken" :-(
> >
> > It is of zero use to downstream users, and it is only being proposed out of
> > the convenience because some tool does it, not because it's correct and
> > best thing to do. We know what the candidates are already based on the tags
> > in the emails which are forever archived.
> >
> > Gary
> >
> > On Tue, May 2, 2023, 15:03 Volkan Yazıcı  wrote:
> >
> > > I support the idea of using `rel/`-prefixed tags both for releases and
> > RCs
> > > (release candidates). It matters for provenance, which is of subject for
> > > RCs too, in particular, the downvoted ones. Next to that, it is
> > intuitive,
> > > one doesn't need to remember two different patterns to access releases
> > and
> > > RCs. Last but not least, these tags are created by CI, hence effortless
> > > from an RMs pov.
> > >
> > > On Tue, May 2, 2023 at 12:09 AM Ralph Goers 
> > > wrote:
> > >
> > > > 1. As noted below you tagged with red/0.1.0-rc2.  You really shouldn’t
> > be
> > > > using rel/ as a tag for candidates. Instead use something like
> > > > tools-1.0-rc2.  rel tags are treated special by Infra and are meant for
> > > > ONLY the “real” release tags (in this case 1.0).
> > > >
> > > > 2. I checked out the tag and ran the build but it seems to hang at
> > > >
> > > > [INFO] --- maven-invoker-plugin:3.5.1:integration-test (default) @
> > > > log4j-transform-maven-plugin ---
> > > > [INFO] Building: location/pom.xml
> > > >
> > > > I ended up killing it after 5 minutes.
> > > >
> > > > Ralph
> > > >
> > > > > On May 1, 2023, at 12:09 PM, Piotr P. Karwasz <
> > piotr.karw...@gmail.com
> > > >
> > > > wrote:
> > > > >
> > > > > The Apache Log4j Transformation Tools 0.1.0 release is now available
> > > for
> > > > voting.
> > > > >
> > > > > This is the first release and it contains two modules:
> > > > >
> > > > > * [LOG4J2-3638]: Adds a bytecode transformation tool to provide
> > > > > location information without reflection.
> > > > > * [LOG4J2-673]: Adds a resource transformer for the Maven Shade
> > Plugin
> > > > > to merge `Log4j2Plugins.dat` plugin caches. Thanks to Eduard
> > > > > Gizatullin.
> > > > >
> > > > > Source repository: https://github.com/apache/logging-log4j-transform
> > > > > Tag: rel/0.1.0-rc2
> > > > > Commit: 7bb767c1466cd9faebfeeffa8136b231bf2b6fae
> > > > > Artifacts:
> > > > https://dist.apache.org/repos/dist/dev/logging/log4j-transform/0.1.0
> > > > > Nexus repository:
> > > > >
> > > https://repository.apache.org/content/repositories/orgapachelogging-1104
> > > > > CI job run:
> > > >
> > >
> > https://github.com/apache/logging-log4j-transform/actions/runs/4853722893
> > > > > Signing key:
> > > >
> > >
> > https://keyserver.ubuntu.com/pks/lookup?search=077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0&fingerprint=on&op=index
> > > > >
> > > > > Please download, test, and cast your votes on the Log4j developers
> > > list.
> > > > >
> > > > > [ ] +1, release the artifacts
> > > > > [ ] -1, don't release, because...
> > > > >
> > > > > The vote will remain open for 72 hours All votes are welcome and we
> > > > > encourage everyone to test the release, but only the Logging Services
> > > > > PMC votes are officially counted. At least 3 +1 votes and more
> > > > > positive than negative votes are required.
> > > > >
> > > > > Countdown:
> > > >
> > >
> > https://www.timeanddate.com/countdown/launch?iso=20230504T2115&p0=4162&font=cursive
> > > > >
> > > > > Piotr
> > > >
> > > >
> > >
> >

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Piotr P. Karwasz]

Hi Volkan,

On Thu, 4 May 2023 at 09:09, Volkan Yazıcı  wrote:
> (NOTICE file is missing, but not a blocker, AFAIC.)

META-INF/{DEPENDENCIES,LICENSE,NOTICE} are generated by the Apache
Maven Remote Resources plugin (courtesy of the ASF parent POM):
https://maven.apache.org/plugins/maven-remote-resources-plugin/index.html
The Velocity templates used to generate them can be found here:
https://github.com/apache/maven-apache-resources/tree/master/jar/src/main/resources/META-INF

The generated resources should probably be included into the source
archive (another reason to use `maven-assembly-plugin`). That is what
the ASF parent POM does.

Piotr

Re: [VOTE] (RC3) Release Apache Log4j Transformation Tools 0.1.0

[Volkan Yazıcı]

+1

Verified signatures, checksums, and LICENSE files.

(NOTICE file is missing, but not a blocker, AFAIC.)

On Tue, May 2, 2023 at 9:09 PM Piotr P. Karwasz 
wrote:

> The Apache Log4j Transformation Tools 0.1.0 release is now available for
> voting.
>
> This is the first release and it contains two modules:
>
> * [LOG4J2-3638]: Adds a bytecode transformation tool to provide
> location information without reflection.
> * [LOG4J2-673]: Adds a resource transformer for the Maven Shade Plugin
> to merge `Log4j2Plugins.dat` plugin caches. Thanks to Eduard
> Gizatullin.
>
> Changes between RC2 and RC3:
>
> * The `log4j-transform-maven-plugin` has a `includes/excludes` setting
> now (useful for benchmark testing),
> * There is a `log4j-transform-perf` module (not in the main reactor
> for a chicken and egg problem),
> * The release was fully automated (hence the 0.1.0-rc1 tag instead of
> 0.1.0-rc3 tag due to some differences between my bash and Github),
> * The source archive does not have Git and Github-related stuff (thanks
> Gary).
>
> Source repository: https://github.com/apache/logging-log4j-transform
> Tag: rel/0.1.0-rc1
> Commit: b49a898f74e1ceaa8cd883f211c0a9c30ef8f5c1
> Artifacts:
> https://dist.apache.org/repos/dist/dev/logging/log4j-transform/0.1.0
> Nexus repository:
> https://repository.apache.org/content/repositories/orgapachelogging-1106
> CI job run:
> https://github.com/apache/logging-log4j-transform/actions/runs/4864531191
> Signing key:
> https://keyserver.ubuntu.com/pks/lookup?search=077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0&fingerprint=on&op=index
> Website: https://logging.staged.apache.org/log4j/2.x/log4j-transform
>
> Please download, test, and cast your votes on the Log4j developers list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> The vote will remain open for 72 hours All votes are welcome and we
> encourage everyone to test the release, but only the Logging Services
> PMC votes are officially counted. At least 3 +1 votes and more
> positive than negative votes are required.
>
> Countdown:
> https://www.timeanddate.com/countdown/launch?iso=20230505T2115&p0=4162&msg=Log4j+Transformation+Tools+0.1.0&font=cursive
>