Re: Log4j 2.22.1 release schedule

[Volkan Yazıcı]

The plan sounds good to me.

I am only not comfortable with the workaround to #2065
. In a nutshell, the
way Coursier/Ivy derives the effective POM doesn't match the one Maven
does. Only to make Coursier/Ivy work, we add redundant dependency
declarations. I am not strongly against this unpleasant workaround, but I
wonder if there is a better way? Could somebody else also weigh in, please?

On Wed, Dec 20, 2023 at 5:46 PM Piotr P. Karwasz 
wrote:

> Hi all,
>
> In the next days I would like to prepare a Log4j 2.22.1 patch release,
> based on this milestone:
>
> https://github.com/apache/logging-log4j2/milestone/10
>
> Could you review the PRs attached? I am only waiting for a PR from a
> user (for a "good-first-issue") and `logging-parent` 10.5.0 and I am
> good to go.
>
> Piotr
>

Re: [log4cxx] Release time?

[Robert Middleton]

If there aren't any objections, I will plan to do a release in a week
or so.  I'm not aware of any issues that need to be fixed, so having a
new release for a new year seems like a good idea.

-Robert Middleton

On Mon, Nov 20, 2023 at 9:53 AM Robert Middleton  wrote:
>
> It's been a bit over 6 months since the last release, is it time for a
> new release?  There aren't many new features that would impact a lot
> of people, but a good number of maintenance fixes.
>
> -Robert Middleton

Re: [VOTE] Release Apache Log4j 3.0.0-beta1 (RC2)

[Ralph Goers]

+1 from me. Everything seems ok.

Ralph

> On Dec 19, 2023, at 2:00 PM, Volkan Yazıcı  wrote:
> 
> This is a vote to release the Apache Log4j 3.0.0-beta1 RC2.
> 
> Website: https://logging.staged.apache.org/log4j/3.x
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 416cd4dcf419b59c88054d2001d34c7fec010560
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: 
> https://repository.apache.org/content/repositories/orgapachelogging-1252
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
> 
> Please download, test, and cast your votes on this mailing list.
> 
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
> 
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted.
> 
> PLEASE USE THIS THREAD ONLY FOR VOTING +1 OR -1. IF YOU HAVE THOUGHTS,
> CONCERNS, QUESTIONS, ETC. SHARE THEM ELSEWHERE. THIS IS A BETA
> RELEASE. WE INTEND TO HAVE SEVERAL OTHER BETA RELEASES. THIS IS NOT
> THE CONCLUSIVE `3.0.0` RELEASE.
> 
> == Review Kit
> 
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
> 
># Check out the distribution
>svn co https://dist.apache.org/repos/... && cd $_
> 
># Verify checksums
>shasum --check *.sha512
> 
># Verify signatures
>wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
>for sigFile in *.asc; do gpg --verify $sigFile; done
> 
># Verify reproduciblity
>umask 0022
>unzip *-src.zip -d src
>cd src
>export NEXUS_REPO=https://repository.apache.org/content/...
>sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
> 
> == Release Notes
> 
> This is the first beta release of the upcoming major release, i.e., `3.0.0`.
> 
> === Added
> 
> * Add annotations for nullability. (LOG4J2-1477)
> * Remove deprecated code. (LOG4J2-2493)
> * Add a more generalized dependency injection system to plugins
> inspired by JSR 330. (LOG4J2-2803)
> * Add and enhance structured properties for per-context settings
> outside configuration files. (LOG4J2-3299[LOG4J2-3299], #1473)
> * Automate artifact publishing and release preparation. (LOG4J2-3466)
> * Add support for dependency injection of plugins into container types
> such as `Optional`, `Collection`, `Set`, `Stream`,
> `List`, and `Map`. (LOG4J2-3496)
> * Add support for `ConstraintValidator` in plugin classes. (LOG4J2-3497)
> 
> === Changed
> 
> * Remove liquibase-log4j2 maven module (#1193)
> * Make the output of annotation processing reproducible. (#1520)
> * Replace `synchronized` blocks with locks for improved performance
> with virtual threads. (#1532)
> * Removes additional `isFiltered` checks in `AsyncLoggerConfig`. (#1550)
> * Ignore exceptions thrown by PropertySources. Eliminate
> ClassCastException when SimpleLoggerContext is used.
> (spring-projects/spring-boot#33450, #1799)
> * Update `com.lmax:disruptor` to version `4.0.0` (#1829)
> * Migrate most tests to JUnit 5. This includes a more powerful set of
> test extensions. (LOG4J2-2653)
> * Make Log4j use its own BOM. (LOG4J2-3511)
> * Change encoding of HTTP Basic Authentication to UTF-8. (#1970)
> * Upgraded the required compiler version to Java 17
> * Upgraded the required runtime version to Java 17
> * Update `actions/checkout` to version `4.1.1` (#1869)
> * Update `actions/setup-java` to version `3.13.0` (#1809)
> * Update `actions/setup-python` to version `4.7.1` (#1831)
> * Update `ch.qos.logback:logback-classic` to version `1.4.14` (#2028)
> * Update `com.datastax.cassandra:cassandra-driver-core` to version
> `3.11.5` (#1889)
> * Update `com.fasterxml.jackson:jackson-bom` to version `2.16.0` (#1974)
> * Update `com.github.luben:zstd-jni` to version `1.5.5-11` (#2032)
> * Update `com.github.spotbugs:spotbugs-maven-plugin` to version
> `4.7.3.6` (#1879)
> * Update `com.github.tomakehurst:wiremock-jre8` to version `2.35.1` (#1765)
> * Update 
> `com.google.code.java-allocation-instrumenter:java-allocation-instrumenter`
> to version `3.3.4` (#2102)
> * Update `com.google.errorprone:error_prone_core` to version `2.23.0` (#1871)
> * Update `com.google.guava:guava-testlib` to version `32.1.3-jre` (#1934)
> * Update `com.h2database:h2` to version `2.2.224` (#1917)
> * Update `commons-codec:commons-codec` to version `1.16.0` (#2054)
> * Update `commons-io:commons-io` to version `2.15.1` (#2035)
> * Update `commons-logging:commons-logging` to version `1.3.0` (#2046)
> * Update `de.flapdoodle.reverse:de.flapdoodle.reverse` to version
> `1.7.2` (#2000)
> * Update `io.netty:netty-bom` to version `4.1.104.Final` (#2097)
> * Update `net.java.dev.jna:jna` to version `5.14.0` (#2082)
> * Update `org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle`
> to version `1.3.7` (#2053)
> * Update `org.apache.commons:commons

Re: [VOTE] Release Apache Log4j 3.0.0-beta1 (RC2)

[Piotr P. Karwasz]

Hi Volkan,

On Tue, 19 Dec 2023 at 22:00, Volkan Yazıcı  wrote:
>
> This is a vote to release the Apache Log4j 3.0.0-beta1 RC2.
>
> Website: https://logging.staged.apache.org/log4j/3.x
> GitHub: https://github.com/apache/logging-log4j2
> Commit: 416cd4dcf419b59c88054d2001d34c7fec010560
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j
> Nexus: 
> https://repository.apache.org/content/repositories/orgapachelogging-1252
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...

I performed:
 * hashes checks,
 * signature checks,
 * ran the tests,
 * verified reproducibility,
 * checked for additional `-test-sources.jar` artifacts or their lack.

Everything seems in order: +1


Piotr

Re: [log4j] Revamping Log4j website & manual tooling

[Christian Grobmeier]

On Wed, Dec 20, 2023, at 17:50, Volkan Yazıcı wrote:
> On Wed, Dec 20, 2023 at 5:05 PM Christian Grobmeier 
> wrote:
>
>> I see only one mention of Antora, the tool you are proposing.
>
>
> I am indeed **not** proposing Antora (removed its mentions), but plain
> AsciiDoc, which is exactly what we have in Log4j, Log4j Kotlin, Log4j
> Scala, Log4j Tools, Log4j Transform, Log4j JMX GUI, Log4j Jakarta, and
> Logging Parent today.

How should I know? In almost every talk we had about this in the past times, 
you were routing for Antora.

> We re-evaluated the options with Piotr today, the multi repository setup,
> multiple Log4j manuals, Log4j configuration wizard in the making, etc. and
> I decided to settle down to what we already have and rather improve the
> experience.

We = you & Piotr? I was surprised to find out you were having a meeting for a 
milestone that also included me.

No more Antora?
Why, all of a sudden?

You have told me many stories about Antora's benefits in the past months. Now, 
are these benefits no longer true? 

> Given everything is already in AsciiDoc and now I clarified that I indeed
> only propose using plain AsciiDoc, I presume I addressed your concerns
> above. Please let me know if there is anything else I should be addressing
> in my document.

No, I don't think you addressed my concerns. 
Please let me know why you re-considered, and Antora seems off the table. 

I don't need to keep Antora, I am not a huge fan, but your message concerns me. 

Re: [VOTE] Release Apache Log4j Kotlin API 1.4.0

[Volkan Yazıcı]

Before Piotr and others start voting -1, let me make a correction: Nexus
URL is incorrect. The correct one is:
https://repository.apache.org/content/repositories/orgapachelogging-1251
(Matt, there is a warning about this in the release instructions. 😉)

On Wed, Dec 20, 2023 at 7:08 PM Matt Sicker  wrote:

> This is a vote to release the Apache Log4j Kotlin API 1.4.0.
>
> Website: https://logging.staged.apache.org/log4j/kotlin
> GitHub: https://github.com/apache/logging-log4j-kotlin
> Commit: ee2d4a8efa16bb2223252329531c94e98ed6d1e6
> Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-kotlin
> Nexus:
> https://repository.apache.org/content/repositories/orgapachelogging-1113
> Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0
>
> Please download, test, and cast your votes on this mailing list.
>
> [ ] +1, release the artifacts
> [ ] -1, don't release, because...
>
> This vote is open for 72 hours and will pass unless getting a
> net negative vote count. All votes are welcome and we encourage
> everyone to test the release, but only the Logging Services PMC
> votes are officially counted. At least 3 +1 votes and more
> positive than negative votes are required.
>
> === Review kit
>
> The minimum set of steps needed to review the uploaded distribution
> files in the Subversion repository can be summarized as follows:
>
> # Check out the distribution
> svn co https://dist.apache.org/repos/... && cd $_
>
> # Verify checksums
> shasum --check *.sha512
>
> # Verify signatures
> wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
> for sigFile in *.asc; do gpg --verify $sigFile; done
>
> # Verify reproduciblity
> umask 0022
> unzip *-src.zip -d src
> cd src
> export NEXUS_REPO=https://repository.apache.org/content/...
> sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO
>
> === Release notes
>
>
> This minor release fixes incorrect coroutine context map and stack.
>
>
>  Added
>
> * Started generating CycloneDX SBOM with the recent update of
> `logging-parent` to version `10.2.0`
>
>  Changed
>
> * Coroutine context is not cleared properly, only appended to (#54)
> * Update `org.apache.logging:logging-parent` to version `10.2.0`
> * Update `org.apache.logging.log4j:log4j-bom` to version `2.22.0` (#52)
> * Update `org.apache.logging:logging-parent` to version `10.4.0` (#53)
> * Update `org.codehaus.mojo:build-helper-maven-plugin` to version `3.5.0`
> (#51)
> * Update `org.codehaus.mojo:exec-maven-plugin` to version `3.1.1` (#50)
> * Update `org.junit:junit-bom` to version `5.10.1` (#49)

[VOTE] Release Apache Log4j Kotlin API 1.4.0

[Matt Sicker]

This is a vote to release the Apache Log4j Kotlin API 1.4.0.

Website: https://logging.staged.apache.org/log4j/kotlin
GitHub: https://github.com/apache/logging-log4j-kotlin
Commit: ee2d4a8efa16bb2223252329531c94e98ed6d1e6
Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-kotlin
Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1113
Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0

Please download, test, and cast your votes on this mailing list.

[ ] +1, release the artifacts
[ ] -1, don't release, because...

This vote is open for 72 hours and will pass unless getting a
net negative vote count. All votes are welcome and we encourage
everyone to test the release, but only the Logging Services PMC
votes are officially counted. At least 3 +1 votes and more
positive than negative votes are required.

=== Review kit

The minimum set of steps needed to review the uploaded distribution
files in the Subversion repository can be summarized as follows:

# Check out the distribution
svn co https://dist.apache.org/repos/... && cd $_

# Verify checksums
shasum --check *.sha512

# Verify signatures
wget -O - https://downloads.apache.org/logging/KEYS | gpg --import
for sigFile in *.asc; do gpg --verify $sigFile; done

# Verify reproduciblity
umask 0022
unzip *-src.zip -d src
cd src
export NEXUS_REPO=https://repository.apache.org/content/...
sh mvnw -Prelease verify artifact:compare -Dreference.repo=$NEXUS_REPO

=== Release notes


This minor release fixes incorrect coroutine context map and stack.


 Added

* Started generating CycloneDX SBOM with the recent update of `logging-parent` 
to version `10.2.0`

 Changed

* Coroutine context is not cleared properly, only appended to (#54)
* Update `org.apache.logging:logging-parent` to version `10.2.0`
* Update `org.apache.logging.log4j:log4j-bom` to version `2.22.0` (#52)
* Update `org.apache.logging:logging-parent` to version `10.4.0` (#53)
* Update `org.codehaus.mojo:build-helper-maven-plugin` to version `3.5.0` (#51)
* Update `org.codehaus.mojo:exec-maven-plugin` to version `3.1.1` (#50)
* Update `org.junit:junit-bom` to version `5.10.1` (#49)

Re: [log4j] Revamping Log4j website & manual tooling

[Volkan Yazıcı]

On Wed, Dec 20, 2023 at 5:05 PM Christian Grobmeier 
wrote:

> I see only one mention of Antora, the tool you are proposing.


I am indeed **not** proposing Antora (removed its mentions), but plain
AsciiDoc, which is exactly what we have in Log4j, Log4j Kotlin, Log4j
Scala, Log4j Tools, Log4j Transform, Log4j JMX GUI, Log4j Jakarta, and
Logging Parent today.

We re-evaluated the options with Piotr today, the multi repository setup,
multiple Log4j manuals, Log4j configuration wizard in the making, etc. and
I decided to settle down to what we already have and rather improve the
experience.


> You don't have to sell us Asciidoc; we all have our opinions about it; the
> majority of the document is about "why not" but little "why Antora"


> I would be more interested in the challenges/benefits of Antora, and how
> such a system could be added to our landscape.
>

Given everything is already in AsciiDoc and now I clarified that I indeed
only propose using plain AsciiDoc, I presume I addressed your concerns
above. Please let me know if there is anything else I should be addressing
in my document.

Log4j 2.22.1 release schedule

[Piotr P. Karwasz]

Hi all,

In the next days I would like to prepare a Log4j 2.22.1 patch release,
based on this milestone:

https://github.com/apache/logging-log4j2/milestone/10

Could you review the PRs attached? I am only waiting for a PR from a
user (for a "good-first-issue") and `logging-parent` 10.5.0 and I am
good to go.

Piotr

Re: [log4j] Revamping Log4j website & manual tooling

[Christian Grobmeier]

I see only one mention of Antora, the tool you are proposing. 
You don't have to sell us Asciidoc; we all have our opinions about it; the 
majority of the document is about "why not" but little "why Antora"

I would be more interested in the challenges/benefits of Antora, and how such a 
system could be added to our landscape. 
Also, can we use one Antora for all subprojects, including Flume, does it need 
to be different Antoras... these kind of things.

On Wed, Dec 20, 2023, at 16:42, Volkan Yazıcı wrote:
> As a part of the planned Log4j website & manual revamp
> , my
> proposal is to stick to what we already have (i.e., AsciiDoc) and just
> automate the publication
> .
> I
> ask for your feedback on this proposal.
>
> Please take into account that this discussion is only about the *tooling*.
> The structure-related discussion can be found here
> .

[log4j] Revamping Log4j website & manual tooling

[Volkan Yazıcı]

As a part of the planned Log4j website & manual revamp
, my
proposal is to stick to what we already have (i.e., AsciiDoc) and just
automate the publication
.
I
ask for your feedback on this proposal.

Please take into account that this discussion is only about the *tooling*.
The structure-related discussion can be found here
.

Re: [VOTE] Release Apache Log4j 3.0.0-beta1

[Gary Gregory]

In these universes (projects): Over the years, many RCs in many projects
have created zip and tars with missing files because assembly descriptors
for the Maven assembly plugin where not updated correctly or created
properly in the first place. The src zip and tar is NOT (usually) a dump of
EVERYTHING is a svn/git repository. A project might contain many extra
files that are not required to build. For example, IIRC I saw an RC once
that included the .git hidden folder.

Gary

On Wed, Dec 20, 2023, 6:56 AM Jochen Wiedmann 
wrote:

> On Tue, Dec 19, 2023 at 2:05 PM Gary Gregory 
> wrote:
>
> > Do note that building from sources, not git, is an Apache requirement.
>
> Okay, but in what universe is building from a Git tag on the sources
> (which is, what the release:perform goal does) different from
> "building from sources"?
>
> Jochen
>

Re: [VOTE] Release Apache Log4j 3.0.0-beta1

[Jochen Wiedmann]

On Tue, Dec 19, 2023 at 2:05 PM Gary Gregory  wrote:

> Do note that building from sources, not git, is an Apache requirement.

Okay, but in what universe is building from a Git tag on the sources
(which is, what the release:perform goal does) different from
"building from sources"?

Jochen