Re: [VOTE] Release Apache Log4j Tools 0.6.0 (RC2)
Adding my +1. With that, the release passes with 3 binding +1 votes from Piotr, Gary, and myself. I will continue the release process. On Fri, Nov 17, 2023 at 10:21 AM Volkan Yazıcı wrote: > > This is a vote to release the Apache Log4j Tools 0.6.0 (RC2). > > Website: https://logging.staged.apache.org/log4j/tools > GitHub: https://github.com/apache/logging-log4j-tools > Commit: a696e081304cc0693d86533013df5b4d886cfb9c > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > Nexus: > https://repository.apache.org/content/repositories/orgapachelogging-1237 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... > > This vote is open for 24 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > === Note on 24 hours deadline > > RC1 vote was created 2 days ago. RC2 only contains missing CycloneDX > SBOMs in the distribution archived by ASF. Note that SBOMs in the > Nexus were already working in RC1. Hence, an extra 24 hours would make > it all add up to 72 hours. > > === Release Notes > > This minor release contains various bug fixes and improvements. > > Added > > * Started generating CycloneDX SBOM with the recent update of > `logging-parent` to version `10.4.0` > > Changed > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > Fixed > > * `log4j-tools-bom` was broken due to removed `parent` during > flattening. This is automatically fixed by the recent `logging-parent` > version `10.4.0` update.
Re: [VOTE] Release Apache Log4j Tools 0.6.0
`log4j-tools-bom:0.5.0` is broken: `parent` is missing. This release (i.e., `0.6.0`) fixes that. On Fri, Nov 17, 2023 at 2:11 PM Gary D. Gregory wrote: > > Seen during 'mvn clean verify' > > [INFO] --- log4j-changelog:0.5.0:export (export-changelog) @ log4j-tools-bom > --- > [WARNING] The POM for org.apache.logging.log4j:log4j-changelog:jar:0.5.0 is > invalid, transitive dependencies (if any) will not be available, enable debug > logging for more details > exported 6 release directories: ..., `C:\tmp\test\src\changelog\0.6.0` > exporting upcoming release directory: `C:\tmp\test\src\changelog\.0.x.x` > > Is that important? What doe sit mean? > > TY! > Gary > > > On 2023/11/15 15:03:13 Volkan Yazıcı wrote: > > This is a vote to release the Apache Log4j Tools 0.6.0. > > > > Website: https://logging.staged.apache.org/log4j/tools > > GitHub: https://github.com/apache/logging-log4j-tools > > Commit: 18425d95a4d150de905929d55bf55545d70f3d91 > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > > Nexus: > > https://repository.apache.org/content/repositories/orgapachelogging-1233 > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > > > Please download, test, and cast your votes on this mailing list. > > > > [ ] +1, release the artifacts > > [ ] -1, don't release, because... > > > > This vote is open for 72 hours and will pass unless getting a > > net negative vote count. All votes are welcome and we encourage > > everyone to test the release, but only the Logging Services PMC > > votes are officially counted. At least 3 +1 votes and more > > positive than negative votes are required. > > > > === Release Notes > > > > This minor release contains various bug fixes and improvements. > > > > Added > > > > * Started generating CycloneDX SBOM with the recent update of > > `logging-parent` to version `10.4.0` > > > > Changed > > > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > > > Fixed > > > > * `log4j-tools-bom` was broken due to removed `parent` during > > flattening. This is automatically fixed by the recent `logging-parent` > > version `10.4.0` update. > >
Re: [VOTE] Release Apache Log4j Tools 0.6.0
Good catch. Though not a big issue; `spotbugs-annotations` dependency is missing. Fixed in `main` via `fb6fee27b349bb7ec5e847a6d33f9abb81b714ec`. On Fri, Nov 17, 2023 at 2:12 PM Gary D. Gregory wrote: > > Also seen during 'mvn clean verify': > > [INFO] --- compiler:3.11.0:compile (default-compile) @ > log4j-changelog-maven-plugin --- > [INFO] Changes detected - recompiling the module! :dependency > [INFO] Compiling 5 source files with javac [debug release 8] to target\classes > [WARNING] Cannot find annotation method 'value()' in type > 'edu.umd.cs.findbugs.annotations.SuppressFBWarnings': class file for > edu.umd.cs.findbugs.annotations.SuppressFBWarnings not found > > > Gary > > On 2023/11/15 15:03:13 Volkan Yazıcı wrote: > > This is a vote to release the Apache Log4j Tools 0.6.0. > > > > Website: https://logging.staged.apache.org/log4j/tools > > GitHub: https://github.com/apache/logging-log4j-tools > > Commit: 18425d95a4d150de905929d55bf55545d70f3d91 > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > > Nexus: > > https://repository.apache.org/content/repositories/orgapachelogging-1233 > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > > > Please download, test, and cast your votes on this mailing list. > > > > [ ] +1, release the artifacts > > [ ] -1, don't release, because... > > > > This vote is open for 72 hours and will pass unless getting a > > net negative vote count. All votes are welcome and we encourage > > everyone to test the release, but only the Logging Services PMC > > votes are officially counted. At least 3 +1 votes and more > > positive than negative votes are required. > > > > === Release Notes > > > > This minor release contains various bug fixes and improvements. > > > > Added > > > > * Started generating CycloneDX SBOM with the recent update of > > `logging-parent` to version `10.4.0` > > > > Changed > > > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > > > Fixed > > > > * `log4j-tools-bom` was broken due to removed `parent` during > > flattening. This is automatically fixed by the recent `logging-parent` > > version `10.4.0` update. > >
Re: [VOTE] Release Apache Log4j Tools 0.6.0 (RC2)
+1 Same warnings as noted previously. - Testing src zip file - OK: ASC verify - OK: SHA check - OK: mvn clean verify Using: Apache Maven 3.9.5 (57804ffe001d7215b5e7bcb531cf83df38f93546) Maven home: C:\java\apache-maven-3.9.5 Java version: 17.0.8, vendor: Eclipse Adoptium, runtime: C:\Program Files\Eclipse Adoptium\jdk-17.0.8.7-hotspot Default locale: en_US, platform encoding: Cp1252 OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows" Microsoft Windows [Version 10.0.19045.3570] Gary On 2023/11/17 09:21:48 Volkan Yazıcı wrote: > This is a vote to release the Apache Log4j Tools 0.6.0 (RC2). > > Website: https://logging.staged.apache.org/log4j/tools > GitHub: https://github.com/apache/logging-log4j-tools > Commit: a696e081304cc0693d86533013df5b4d886cfb9c > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > Nexus: > https://repository.apache.org/content/repositories/orgapachelogging-1237 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... > > This vote is open for 24 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > === Note on 24 hours deadline > > RC1 vote was created 2 days ago. RC2 only contains missing CycloneDX > SBOMs in the distribution archived by ASF. Note that SBOMs in the > Nexus were already working in RC1. Hence, an extra 24 hours would make > it all add up to 72 hours. > > === Release Notes > > This minor release contains various bug fixes and improvements. > > Added > > * Started generating CycloneDX SBOM with the recent update of > `logging-parent` to version `10.4.0` > > Changed > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > Fixed > > * `log4j-tools-bom` was broken due to removed `parent` during > flattening. This is automatically fixed by the recent `logging-parent` > version `10.4.0` update. >
Re: [VOTE] Release Apache Log4j Tools 0.6.0
Also seen during 'mvn clean verify': [INFO] --- compiler:3.11.0:compile (default-compile) @ log4j-changelog-maven-plugin --- [INFO] Changes detected - recompiling the module! :dependency [INFO] Compiling 5 source files with javac [debug release 8] to target\classes [WARNING] Cannot find annotation method 'value()' in type 'edu.umd.cs.findbugs.annotations.SuppressFBWarnings': class file for edu.umd.cs.findbugs.annotations.SuppressFBWarnings not found Gary On 2023/11/15 15:03:13 Volkan Yazıcı wrote: > This is a vote to release the Apache Log4j Tools 0.6.0. > > Website: https://logging.staged.apache.org/log4j/tools > GitHub: https://github.com/apache/logging-log4j-tools > Commit: 18425d95a4d150de905929d55bf55545d70f3d91 > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > Nexus: > https://repository.apache.org/content/repositories/orgapachelogging-1233 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... > > This vote is open for 72 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > === Release Notes > > This minor release contains various bug fixes and improvements. > > Added > > * Started generating CycloneDX SBOM with the recent update of > `logging-parent` to version `10.4.0` > > Changed > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > Fixed > > * `log4j-tools-bom` was broken due to removed `parent` during > flattening. This is automatically fixed by the recent `logging-parent` > version `10.4.0` update. >
Re: [VOTE] Release Apache Log4j Tools 0.6.0
Seen during 'mvn clean verify' [INFO] --- log4j-changelog:0.5.0:export (export-changelog) @ log4j-tools-bom --- [WARNING] The POM for org.apache.logging.log4j:log4j-changelog:jar:0.5.0 is invalid, transitive dependencies (if any) will not be available, enable debug logging for more details exported 6 release directories: ..., `C:\tmp\test\src\changelog\0.6.0` exporting upcoming release directory: `C:\tmp\test\src\changelog\.0.x.x` Is that important? What doe sit mean? TY! Gary On 2023/11/15 15:03:13 Volkan Yazıcı wrote: > This is a vote to release the Apache Log4j Tools 0.6.0. > > Website: https://logging.staged.apache.org/log4j/tools > GitHub: https://github.com/apache/logging-log4j-tools > Commit: 18425d95a4d150de905929d55bf55545d70f3d91 > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > Nexus: > https://repository.apache.org/content/repositories/orgapachelogging-1233 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... > > This vote is open for 72 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > === Release Notes > > This minor release contains various bug fixes and improvements. > > Added > > * Started generating CycloneDX SBOM with the recent update of > `logging-parent` to version `10.4.0` > > Changed > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > Fixed > > * `log4j-tools-bom` was broken due to removed `parent` during > flattening. This is automatically fixed by the recent `logging-parent` > version `10.4.0` update. >
Re: [VOTE] Release Apache Log4j Tools 0.6.0 (RC2)
Hi Volkan, On Fri, 17 Nov 2023 at 10:21, Volkan Yazıcı wrote: > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... I have rechecked: * the hashes of all artifacts against locally generated ones, * the hashes and signatures of the ZIP archives (I believe Nexus does it for Maven artifacts), * the presence of `logging-parent` in the flattened `log4j-tools-bom`, * the presence of CycloneDX files in the bin archive. +1 Piotr
Re: [VOTE] Release Apache Log4j Tools 0.6.0 (RC2)
Hi Volkan, On Fri, 17 Nov 2023 at 10:21, Volkan Yazıcı wrote: > This vote is open for 24 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > === Note on 24 hours deadline > > RC1 vote was created 2 days ago. RC2 only contains missing CycloneDX > SBOMs in the distribution archived by ASF. Note that SBOMs in the > Nexus were already working in RC1. Hence, an extra 24 hours would make > it all add up to 72 hours. I agree with the shorter deadline, but the vote for RC2 should not end before the original deadline for RC1, which was: Saturday, 18th, 15:04 UTC This means the vote should be open for around 30 hours. Piotr
[VOTE] Release Apache Log4j Tools 0.6.0 (RC2)
This is a vote to release the Apache Log4j Tools 0.6.0 (RC2). Website: https://logging.staged.apache.org/log4j/tools GitHub: https://github.com/apache/logging-log4j-tools Commit: a696e081304cc0693d86533013df5b4d886cfb9c Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1237 Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 Please download, test, and cast your votes on this mailing list. [ ] +1, release the artifacts [ ] -1, don't release, because... This vote is open for 24 hours and will pass unless getting a net negative vote count. All votes are welcome and we encourage everyone to test the release, but only the Logging Services PMC votes are officially counted. At least 3 +1 votes and more positive than negative votes are required. === Note on 24 hours deadline RC1 vote was created 2 days ago. RC2 only contains missing CycloneDX SBOMs in the distribution archived by ASF. Note that SBOMs in the Nexus were already working in RC1. Hence, an extra 24 hours would make it all add up to 72 hours. === Release Notes This minor release contains various bug fixes and improvements. Added * Started generating CycloneDX SBOM with the recent update of `logging-parent` to version `10.4.0` Changed * Update `org.apache.logging:logging-parent` to version `10.4.0` Fixed * `log4j-tools-bom` was broken due to removed `parent` during flattening. This is automatically fixed by the recent `logging-parent` version `10.4.0` update.
Re: [VOTE] Release Apache Log4j Tools 0.6.0
Doh! As you stated [in your DM], `build.yaml` still contains the deprecated `distribution-attachment-filepath-pattern`, which doesn't match against SBOMs. I am cancelling this vote. I will issue an RC2 promptly. On Fri, Nov 17, 2023 at 9:36 AM Piotr P. Karwasz wrote: > > Hi Volkan, > > On Fri, 17 Nov 2023 at 09:22, Volkan Yazıcı wrote: > > > > They are. See `*-bin.zip`. > > > > On Fri, Nov 17, 2023 at 9:13 AM Christian Grobmeier > > wrote: > > > > > > Should the SBOM/CycloneDX files be part of the distribution folder as > > > well? > > > https://dist.apache.org/repos/dist/dev/logging/log4j-tools/ > > I can't find them either: the `log4j-jmx-gui` archive contains the > SBOMs, but the `log4j-tools` archive doesn't. > > Piotr
Re: [VOTE] Release Apache Log4j Tools 0.6.0
Hi Volkan, On Fri, 17 Nov 2023 at 09:22, Volkan Yazıcı wrote: > > They are. See `*-bin.zip`. > > On Fri, Nov 17, 2023 at 9:13 AM Christian Grobmeier > wrote: > > > > Should the SBOM/CycloneDX files be part of the distribution folder as well? > > https://dist.apache.org/repos/dist/dev/logging/log4j-tools/ I can't find them either: the `log4j-jmx-gui` archive contains the SBOMs, but the `log4j-tools` archive doesn't. Piotr
Re: [VOTE] Release Apache Log4j Tools 0.6.0
They are. See `*-bin.zip`. On Fri, Nov 17, 2023 at 9:13 AM Christian Grobmeier wrote: > > Should the SBOM/CycloneDX files be part of the distribution folder as well? > https://dist.apache.org/repos/dist/dev/logging/log4j-tools/ > > > On Wed, Nov 15, 2023, at 16:03, Volkan Yazıcı wrote: > > This is a vote to release the Apache Log4j Tools 0.6.0. > > > > Website: https://logging.staged.apache.org/log4j/tools > > GitHub: https://github.com/apache/logging-log4j-tools > > Commit: 18425d95a4d150de905929d55bf55545d70f3d91 > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > > Nexus: > > https://repository.apache.org/content/repositories/orgapachelogging-1233 > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > > > Please download, test, and cast your votes on this mailing list. > > > > [ ] +1, release the artifacts > > [ ] -1, don't release, because... > > > > This vote is open for 72 hours and will pass unless getting a > > net negative vote count. All votes are welcome and we encourage > > everyone to test the release, but only the Logging Services PMC > > votes are officially counted. At least 3 +1 votes and more > > positive than negative votes are required. > > > > === Release Notes > > > > This minor release contains various bug fixes and improvements. > > > > Added > > > > * Started generating CycloneDX SBOM with the recent update of > > `logging-parent` to version `10.4.0` > > > > Changed > > > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > > > Fixed > > > > * `log4j-tools-bom` was broken due to removed `parent` during > > flattening. This is automatically fixed by the recent `logging-parent` > > version `10.4.0` update.
Re: [VOTE] Release Apache Log4j Tools 0.6.0
Should the SBOM/CycloneDX files be part of the distribution folder as well? https://dist.apache.org/repos/dist/dev/logging/log4j-tools/ On Wed, Nov 15, 2023, at 16:03, Volkan Yazıcı wrote: > This is a vote to release the Apache Log4j Tools 0.6.0. > > Website: https://logging.staged.apache.org/log4j/tools > GitHub: https://github.com/apache/logging-log4j-tools > Commit: 18425d95a4d150de905929d55bf55545d70f3d91 > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > Nexus: > https://repository.apache.org/content/repositories/orgapachelogging-1233 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... > > This vote is open for 72 hours and will pass unless getting a > net negative vote count. All votes are welcome and we encourage > everyone to test the release, but only the Logging Services PMC > votes are officially counted. At least 3 +1 votes and more > positive than negative votes are required. > > === Release Notes > > This minor release contains various bug fixes and improvements. > > Added > > * Started generating CycloneDX SBOM with the recent update of > `logging-parent` to version `10.4.0` > > Changed > > * Update `org.apache.logging:logging-parent` to version `10.4.0` > > Fixed > > * `log4j-tools-bom` was broken due to removed `parent` during > flattening. This is automatically fixed by the recent `logging-parent` > version `10.4.0` update.
Re: [VOTE] Release Apache Log4j Tools 0.6.0
Hi Volkan, On Wed, 15 Nov 2023 at 16:10, Volkan Yazıcı wrote: > > This is a vote to release the Apache Log4j Tools 0.6.0. > > Website: https://logging.staged.apache.org/log4j/tools > GitHub: https://github.com/apache/logging-log4j-tools > Commit: 18425d95a4d150de905929d55bf55545d70f3d91 > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools > Nexus: > https://repository.apache.org/content/repositories/orgapachelogging-1233 > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > Please download, test, and cast your votes on this mailing list. > > [ ] +1, release the artifacts > [ ] -1, don't release, because... I checked: * the artifacts reproducibility from source, * that the checksums of the binary archive correspond to those on Maven, * that the hierarchy of POM files is complete. +1 Piotr
[VOTE] Release Apache Log4j Tools 0.6.0
This is a vote to release the Apache Log4j Tools 0.6.0. Website: https://logging.staged.apache.org/log4j/tools GitHub: https://github.com/apache/logging-log4j-tools Commit: 18425d95a4d150de905929d55bf55545d70f3d91 Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j-tools Nexus: https://repository.apache.org/content/repositories/orgapachelogging-1233 Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 Please download, test, and cast your votes on this mailing list. [ ] +1, release the artifacts [ ] -1, don't release, because... This vote is open for 72 hours and will pass unless getting a net negative vote count. All votes are welcome and we encourage everyone to test the release, but only the Logging Services PMC votes are officially counted. At least 3 +1 votes and more positive than negative votes are required. === Release Notes This minor release contains various bug fixes and improvements. Added * Started generating CycloneDX SBOM with the recent update of `logging-parent` to version `10.4.0` Changed * Update `org.apache.logging:logging-parent` to version `10.4.0` Fixed * `log4j-tools-bom` was broken due to removed `parent` during flattening. This is automatically fixed by the recent `logging-parent` version `10.4.0` update.
