Re: [VOTE] Release Apache Commons Daemon 1.4.0 based on RC1

2024-05-20 Thread Mark Thomas
On 17/05/2024 19:05, Mark Thomas wrote:   [X] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [ ] -1 I oppose this release because... Signatures confirmed for Windows binaries. Tested successfully with Tomcat 11.0.x build. Mark

Re: [VOTE] Release Apache Commons Daemon 1.4.0 based on RC1

2024-05-18 Thread Mark Thomas
-RC1/source/ https://dist.apache.org/repos/dist/dev/commons/daemon/1.4.0-RC1/binaries/ Gary On Fri, May 17, 2024 at 2:06 PM Mark Thomas wrote: We have fixed a few bugs, added enhancements and updated the minimum Java and Windows version since Apache Commons Daemon 1.3.4 was released, so I would

[VOTE] Release Apache Commons Daemon 1.4.0 based on RC1

2024-05-17 Thread Mark Thomas
will close no sooner than 72 hours from now. [ ] +1 Release these artifacts [ ] +0 OK, but... [ ] -0 OK, but really should fix... [ ] -1 I oppose this release because... Thank you, Mark Thomas, Release Manager (using key 10C01C5A2F6059E7) For following is intended as a helper and refresher

Re: [Daemon] Anything to appease "Wrong type of arguments to formatting function"

2024-05-17 Thread Mark Thomas
Set them as false positives or just ignore them. Mark On 17/05/2024 15:09, Gary Gregory wrote: Mark and all: Is there anything smile to do to appease the warnings "Wrong type of arguments to formatting function" in see https://github.com/apache/commons-daemon/security/code-scanning ? TY

Re: [Meta] gitlab error responses to mailing list

2023-08-10 Thread Mark Thomas
rate limited. You should received it in the next few hours. Mark On 10/08/2023 09:48, Mark Thomas wrote: Hi all, In an effort to trace the idiot that set up whatever process is triggering these messages directly to anyone who posts to the dev list I will be sending out some test messages

Re: [Meta] gitlab error responses to mailing list

2023-08-10 Thread Mark Thomas
for the noise. Mark On 07/08/2023 15:40, Gilles Sadowski wrote: Le lun. 7 août 2023 à 16:38, Gilles Sadowski a écrit : Le lun. 7 août 2023 à 10:46, Mark Thomas a écrit : Got the error message. To help me play hunt the subscriber, can anyone provide information on when this behaviour started? I

Re: [Codec] clearing input byte array vs not

2023-08-09 Thread Mark Thomas
Reject it. And document the existing behavior. Mark On 09/08/2023 19:52, Gary Gregory wrote: Hi all, Any thoughts on https://github.com/apache/commons-codec/pull/197 Gary - To unsubscribe, e-mail:

Re: [Meta] gitlab error responses to mailing list

2023-08-07 Thread Mark Thomas
Got the error message. To help me play hunt the subscriber, can anyone provide information on when this behaviour started? Thanks, Mark On 07/08/2023 09:44, Mark Thomas wrote: ".invalid" is something that the ASF adds to addresses. See https://infra.apach

Re: [Meta] gitlab error responses to mailing list

2023-08-07 Thread Mark Thomas
".invalid" is something that the ASF adds to addresses. See https://infra.apache.org/blog/dmarc_filtering_on_lists_that.html Hopefully I'll get a similar error message from gitlab in response to this. I'll see if I can track down which mailing list subscriber is triggering it. Mark On

Re: [FileUpload] Major version 2

2023-07-21 Thread Mark Thomas
On 21/07/2023 16:18, Gary Gregory wrote: Now that 2.0.0-M1 is out the door, let's talk about Java platform requirements. I propose that for 2.0.0, FileUpload be bumped from Java 8 to 11, if not 17. +1 for Java 17 Mark If you are going to ask why, see my reply in the [pool] thread

Re: [VOTE] Release Apache Commons Pool 2.12.0 based on RC1

2023-06-29 Thread Mark Thomas
On 28/06/2023 14:16, Gary Gregory wrote: Hi All and Phil. I haven't been that involved in Pool recently but Pool remains a key dependency for Tomcat (via DBCP). The main driver here was two combine keeping binary compatibility _and_ benefit call sites of the API by _not_ having to catch

Re: Project

2023-06-09 Thread Mark Thomas
Harvey, Where did you find the task below? It looks like data from the old "help wanted" system and I thought that had been disabled some time ago. The task was created ~7 years ago so is somewhat out of date. Commons Daemon has since moved to git https://github.com/apache/commons-daemon/

[ANNOUNCEMENT] Commons Daemon 1.3.4 Released

2023-05-12 Thread Mark Thomas
The Apache Commons Team is pleased to announce the availability of Apache Commons Daemon 1.3.4. The Apache Commons Daemon software library provides a generic Daemon (unix) or Service (Windows) wrapper for Java code. Version 1.3.4 is a bugfix release. A full list of changes can be found at

[VOTE][RESULT] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-12 Thread Mark Thomas
The following votes were cast: Binding: +1: ggregory, markt, kinow No other votes were cast. The vote therefore passes. Thanks to everyone who contributed to this release. Mark - To unsubscribe, e-mail:

Re: [VOTE] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-09 Thread Mark Thomas
On 05/05/2023 11:27, Mark Thomas wrote: Please review the release candidate and vote. This vote will close no sooner than 72 hours from now.   [X] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [ ] -1 I oppose this release because... Mark

Re: [VOTE] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-06 Thread Mark Thomas
n. This can be obtained from: https://github.com/mturk/cmsc Version: 15.0.44" Is this true for this release? Gary On 2023/05/05 10:27:23 Mark Thomas wrote: We have fixed a few bugs since Apache Commons Daemon 1.3.3 was released, so I would like to release Apache Commons Daemon 1.3.4. Apac

Re: [VOTE] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-06 Thread Mark Thomas
b.com/mturk/cmsc Version: 15.0.44" Is this true for this release? Yes. Mark Gary On 2023/05/05 10:27:23 Mark Thomas wrote: We have fixed a few bugs since Apache Commons Daemon 1.3.3 was released, so I would like to release Apache Commons Daemon 1.3.4. Apache Commons Daemon

Re: [VOTE] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-05 Thread Mark Thomas
/changes.xml#L43 Mark Gary On Fri, May 5, 2023, 06:31 Gary Gregory wrote: The release notes are empty. Gary On Fri, May 5, 2023, 06:27 Mark Thomas wrote: We have fixed a few bugs since Apache Commons Daemon 1.3.3 was released, so I would like to release Apache Commons Daemon 1.3.4. Apache

[VOTE] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-05 Thread Mark Thomas
OK, but really should fix... [ ] -1 I oppose this release because... Thank you, Mark Thomas, Release Manager (using key 10C01C5A2F6059E7) - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e

Re: Request for Information: Commons Text

2023-05-04 Thread Mark Thomas
On 04/05/2023 16:44, Zhang, Cynthia X. (GSFC-710.0)[BOOZ ALLEN HAMILTON] wrote: Hello, my name is Cynthia Zhang and I am a Supply Chain Risk Management Analyst at NASA. NASA is currently conducting a supply chain assessment of Commons Text. We are interested in confirming the following

Re: [BCEL] https://github.com/apache/commons-bcel/pull/177

2023-04-10 Thread Mark Thomas
Looks plausible to me (or did you mean a different Mark?). Mark On 10/04/2023 15:13, Gary D. Gregory wrote: Mark and all, Any thoughts on https://github.com/apache/commons-bcel/pull/177 ? Gary - To unsubscribe, e-mail:

Re: Nexus: Staging Repository Dropped

2023-02-20 Thread Mark Thomas
"Apache-Maven/3.8.4 (Java 1.8.0_362; Linux 5.19.0-32-generic)" * "userId" = "markt" * "ip" = "81.159.69.115" *Details:* The orgapachecommons-1621 staging repository has been dropped. Action performed by Mark Thomas (markt) ---

[SECURITY] CVE-2023-24998 Apache Commons FileUpload - DoS with excessive parts

2023-02-20 Thread Mark Thomas
CVE-2023-24998 Apache Commons FileUpload - DoS with excessive parts Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Commons FileUpload 1.0-beta-1 to 1.4 Description: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be

[ANNOUNCE] Apache Commons FIleUpload 1.5 Released

2023-02-13 Thread Mark Thomas
The Apache Commons Team is pleased to announce the release of Apache Commons FileUpload 1.5. The Commons FileUpload software library makes it easy to add robust, high-performance, file upload capability to your servlets and web applications. Source and binary distributions are available for

[VOTE][RESULT] Release Apache Commons FileUpload 1.5 based on RC1

2023-02-13 Thread Mark Thomas
The following votes were cast: Binding: +1: kinow, markt, ggregory No other votes were cast. The vote therefore passes. Thanks to everyone who contributed to this release. Mark - To unsubscribe, e-mail:

Re: [VOTE] Release Apache Commons FileUpload 1.5 based on RC1

2023-02-09 Thread Mark Thomas
Ping. One more PMC member vote required. Mark On 01/02/2023 12:57, Mark Thomas wrote: We have fixed a few bugs and added some small enhancements since FileUpload 1.4 was released, so I would like to release FileUpload 1.5. FileUpload 1.5 RC1 is available for review here: https

Re: [VOTE] Release Apache Commons FileUpload 1.5 based on RC1

2023-02-03 Thread Mark Thomas
On 01/02/2023 12:57, Mark Thomas wrote: Please review the release candidate and vote. This vote will close no sooner that 72 hours from now, i.e. sometime after 13:00 UTC 4 Feb 2023   [X] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [ ] -1 I oppose

[VOTE] Release Apache Commons FileUpload 1.5 based on RC1

2023-02-01 Thread Mark Thomas
We have fixed a few bugs and added some small enhancements since FileUpload 1.4 was released, so I would like to release FileUpload 1.5. FileUpload 1.5 RC1 is available for review here: https://dist.apache.org/repos/dist/dev/commons/fileupload/1.5-RC1 (svn revision 59794) The tag is here:

Re: [FILEUPLOAD] State of the 1.6 branch

2023-01-03 Thread Mark Thomas
On 03/01/2023 09:52, Mark Thomas wrote: On 15/12/2022 18:54, Jochen Wiedmann wrote: On Wed, Dec 14, 2022 at 12:20 PM Mark Thomas wrote: - Delete the b2_0 branch - Move the head of the b1_4 branch to the 1.4 tag - Update the b1_4 branch for development of 1.4.1     (or should that be 1.5

Re: [FILEUPLOAD] State of the 1.6 branch

2023-01-03 Thread Mark Thomas
On 15/12/2022 18:54, Jochen Wiedmann wrote: On Wed, Dec 14, 2022 at 12:20 PM Mark Thomas wrote: - Delete the b2_0 branch - Move the head of the b1_4 branch to the 1.4 tag - Update the b1_4 branch for development of 1.4.1 (or should that be 1.5 and start a new branch?) - Back-port my

Re: Jakarta namespace in commons like dbcp - thoughts / ideas?

2022-12-16 Thread Mark Thomas
On 16/12/2022 13:24, Gary Gregory wrote: Thank you Richard for starting this thread. My view is simpler perhaps: I would not make this about the javax vs Jakarta namespaces. I don't want to double the numbers of jars we produce from the same branch for affected components as one of the scheme

Re: [FILEUPLOAD] State of the 1.6 branch

2022-12-15 Thread Mark Thomas
On 14/12/2022 12:12, Gilles Sadowski wrote: Hi. Le mer. 14 déc. 2022 à 12:25, Gary Gregory a écrit : I would create a branch called "1.x" instead and bump the version in the POM to 1.5.0. FYI, I've been using the x.y.z version format in most of not all components I work on, I find that it

[FILEUPLOAD] State of the 1.6 branch

2022-12-14 Thread Mark Thomas
Hi all, I was looking into the possibility of back-porting my recent file count limit change to 1.4 and I think the Github branch is rather out of sync. Using gitk to explore the history, the last commit on the b1_4 branch was eed3e5 on 2017-06-03 But the 1.4 tag is at 047f315 on

[VOTE][RESULT] Release Apache Commons Daemon 1.3.3 based on RC1

2022-11-29 Thread Mark Thomas
The following votes were cast: Binding: +1: ggregory, markt, kinow No other votes were cast. The vote therefore passes. Thanks to everyone who contributed to this release. Mark On 23/11/2022 20:45, Mark Thomas wrote: We have fixed a few bugssince Apache Commons Daemon 1.3.2 was released

Re: [VOTE] Release Apache Commons Daemon 1.3.3 based on RC1

2022-11-24 Thread Mark Thomas
On 23/11/2022 20:45, Mark Thomas wrote: Please review the release candidate and vote. This vote will close no sooner than 72 hours from now.   [X] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [ ] -1 I oppose this release because... Tested

[VOTE] Release Apache Commons Daemon 1.3.3 based on RC1

2022-11-23 Thread Mark Thomas
, Mark Thomas, Release Manager (using key 10C01C5A2F6059E7) For following is intended as a helper and refresher for reviewers. Validating a release candidate == These guidelines are NOT complete. Requirements: Git, Java, Maven. You can validate a release from a release

Re: [commons-daemon] tag commons-daemon-1.3.2 created (now 4189f27)

2022-11-23 Thread Mark Thomas
No. We only had the RC1 tag for 1.3.2. This just creates a duplicate tag for that version without the RC1 suffix. But I did spot the need for it while preparing for 1.3.3-RC1. Mark On 23/11/2022 19:34, Gary Gregory wrote: Don't you mean 1.3.3? Gary On Wed, Nov 23, 2022, 14:32 wrote:

Re: Correctly configuring Apache Commons components for oss-fuzz

2022-11-23 Thread Mark Thomas
sues and high false positive rate. Mark Best, Oliver On Sun, 20 Nov 2022 at 21:24, Mark Thomas wrote: Hi Oliver, The following are a couple of (hopefully) low hanging fruit that will smooth a couple of rough edges. These aren't the biggest issues - just something to get started with. a) It w

[DAEMON] Expecting to tag tomorrow

2022-11-22 Thread Mark Thomas
Hi all, This is just a heads up. I've just fixed a bug in DAEMON so I am expecting to tag 1.3.3 tomorrow so the next round of Tomcat releases can pick up a version of Daemon with the fix. Mark - To unsubscribe, e-mail:

Re: [commons-bcel] branch master updated: Validate the u4 length of all attributes

2022-11-22 Thread Mark Thomas
On 22/11/2022 13:10, Gary D. Gregory wrote: I am concerned that the recent fixes we've made through OSS fuzz and code inspection to validate input are semantically incorrect: The verifier should catch these errors, not the construction of Java objects. This could be a case where fuzzing and

Re: Correctly configuring Apache Commons components for oss-fuzz

2022-11-20 Thread Mark Thomas
to walk through your concerns and reach a good outcome. Best regards, -- Oliver On Thu, 17 Nov 2022 at 06:56, Mark Thomas <mailto:ma...@apache.org>> wrote: I haven't forgotten about this. I am currently working through the open issues. I want to complete first that so feedback isn

Re: Correctly configuring Apache Commons components for oss-fuzz

2022-11-16 Thread Mark Thomas
ackle best. There was already some valuable feedback for Apache Tomcat in https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53153. Let us extend this collaboration. We can discuss and agree on the attack vectors in apache-commons components. Best regards Roman On Thu, Nov 10, 2022 at 10:29 AM M

Re: Correctly configuring Apache Commons components for oss-fuzz

2022-11-10 Thread Mark Thomas
org>" as primary contact. OSS-Fuzz could have some additional documentation for that. @Oliver Chang <mailto:och...@google.com> do you have any ideas here? Best regards Roman On Tue, Nov 8, 2022 at 5:56 PM Mark Thomas mailto:ma...@apache.org>> wrote:

Re: Correctly configuring Apache Commons components for oss-fuzz

2022-11-08 Thread Mark Thomas
wrote: Sounds good. Gary On Tue, Nov 8, 2022, 10:07 Mark Thomas wrote: There has been no response to this email from anyone from Code Intelligence. Unless there are objections from the Apache Commons Community my next step will be to submit a PR to have the following modules removed from

Re: Correctly configuring Apache Commons components for oss-fuzz

2022-11-08 Thread Mark Thomas
. Mark On 19/10/2022 10:56, Mark Thomas wrote: Hi, You are receiving this email as you are currently configured as the recipients for oss-fuzz reports for Apache Commons JXPath. As per the discussion on the Apache Commons dev list[1], please make the following configuration changes

Re: JEXL Security

2022-10-31 Thread Mark Thomas
On 31/10/2022 14:03, Henri Biestro wrote: Let's restrict this discussion to the case of 'authenticated and authorised users' of an 'enterprise platform'. When we talk about 'unsafe input' vs 'safe input', I'm still confused about what this actually entails. Let's assume we want those users to

Re: JEXL Security

2022-10-26 Thread Mark Thomas
On 26/10/2022 08:58, Henri Biestro wrote: Fair points, thank you. They seem to lead into the point of view that JEXL (or any scripting solution?) should not expose any feature that could be considered security-related avoiding the CVE potential turmoils alltogether. Trusted sanitised input is

Re: Publish statement on Commons Text CVE

2022-10-24 Thread Mark Thomas
On 24/10/2022 19:54, Gary Gregory wrote: The problem is that you sent your message from what I assume is a bogus email reply address: p...@wolfgang-jung.net.invalid No, the ".invalid" was added by the ASF mail servers. See: https://blogs.apache.org/infra/entry/dmarc_filtering_on_lists_that

Re: JEXL Security

2022-10-24 Thread Mark Thomas
On 24/10/2022 17:02, Henri Biestro (Apache) wrote: Hello Commons; JEXL-381 is an attempt at making JEXL's default more secure or at least less 'permeable' wrt to the application/platform/JVM/file-system/host that runs it. Based on JexlPermissions - a crude security visibility manager -, this

Correctly configuring Apache Commons components for oss-fuzz

2022-10-19 Thread Mark Thomas
Hi, You are receiving this email as you are currently configured as the recipients for oss-fuzz reports for Apache Commons JXPath. As per the discussion on the Apache Commons dev list[1], please make the following configuration changes to the oss-fuzz integrations with immediate effect: -

Re: [jxpath] reported CVE and path forward

2022-10-19 Thread Mark Thomas
On 15/10/2022 17:12, Mark Thomas wrote: On 11/10/2022 16:25, Mike Drob wrote: Thanks for this outline, Mark. Some questions in line. Mike On Tue, Oct 11, 2022 at 6:13 AM Mark Thomas wrote: Roman - don't do anything yet. Commons folk, I suggest the following which is based on how we have

Re: [jxpath] reported CVE and path forward

2022-10-15 Thread Mark Thomas
On 11/10/2022 16:25, Mike Drob wrote: Thanks for this outline, Mark. Some questions in line. Mike On Tue, Oct 11, 2022 at 6:13 AM Mark Thomas wrote: Roman - don't do anything yet. Commons folk, I suggest the following which is based on how we have oss-fuzz setup on Tomcat. 1. Create

Re: [jxpath] reported CVE and path forward

2022-10-11 Thread Mark Thomas
RCE. I have verified the vulnerability and for me it seems to be a valid RCE. @Mark Thomas should we continue to discuss further details via secur...@apache.org? Best regards Roman - To unsubscribe, e-mail: dev-unsubscr

Re: [jxpath] reported CVE and path forward

2022-10-10 Thread Mark Thomas
Hmm. There are various red flags here that suggest to me that this issue is likely not valid. 1. The source is oss-fuzz. I have been dealing with oss-fuzz issues for Apache Tomcat and so far out of the 30+ issues raised (the majority marked as security relevant) not one of the issues was a

[ANNOUNCEMENT] Commons Daemon 1.3.2 Released

2022-10-10 Thread Mark Thomas
The Apache Commons Team is pleased to announce the availability of Apache Commons Daemon 1.3.2. The Apache Commons Daemon software library provides a generic Daemon (unix) or Service (Windows) wrapper for Java code. Version 1.3.2 is a bugfix release. A full list of changes can be found at

[VOTE][RESULT] Release Apache Commons Daemon 1.3.2 based on RC1

2022-10-10 Thread Mark Thomas
The following votes were cast: Binding: +1: markt, linow, ggregory No other votes were cast. The vote therefore passes. Thanks to everyone who contributed to this release. Mark On 05/10/2022 15:36, Mark Thomas wrote: We have fixed a few bugs since Apache Commons Daemon 1.3.1 was released

Re: [VOTE] Release Apache Commons Daemon 1.3.2 based on RC1

2022-10-07 Thread Mark Thomas
On 05/10/2022 15:36, Mark Thomas wrote: Please review the release candidate and vote. This vote will close no sooner than 72 hours from now.   [X] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [ ] -1 I oppose this release because... Mark

[VOTE] Release Apache Commons Daemon 1.3.2 based on RC1

2022-10-05 Thread Mark Thomas
... [ ] -1 I oppose this release because... Thank you, Mark Thomas, Release Manager (using key 10C01C5A2F6059E7) For following is intended as a helper and refresher for reviewers. Validating a release candidate == These guidelines are NOT complete. Requirements

Re: [Daemon] release soon?

2022-10-04 Thread Mark Thomas
I'll try and take a look this month. Mark On 04/10/2022 12:47, Gary Gregory wrote: Hi Mark or anyone, Do you have any time for releasing Daemon to pick up the logging fix? Thank you, Gary - To unsubscribe, e-mail:

[ANNOUNCEMENT] Commons Daemon 1.3.1 Released

2022-05-09 Thread Mark Thomas
The Apache Commons Team is pleased to announce the availability of Apache Commons Daemon 1.3.1. The Apache Commons Daemon software library provides a generic Daemon (unix) or Service (Windows) wrapper for Java code. Version 1.3.1 is a mainly bugfix release. A full list of changes can be found

Re: [VOTE] Release Apache Commons Daemon 1.3.1 based on RC1

2022-05-09 Thread Mark Thomas
On 05/05/2022 14:04, Gary Gregory wrote: Can't build the site due to https://issues.apache.org/jira/browse/RAT-300 The JDepend plugin has a similar issue. For the benefit of the archives I built both the RAT plugin and JDepend plugin from source and then built the site for the 1.3.1 release

[VOTE][RESULT] Release Apache Commons Daemon 1.3.1 based on RC1

2022-05-09 Thread Mark Thomas
The following votes were cast: Binding: +1: kinow, markt, ggregory The vote therefore passes. Mark - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org

Re: [VOTE] Release Apache Commons Daemon 1.3.1 based on RC1

2022-05-04 Thread Mark Thomas
On 03/05/2022 16:43, Mark Thomas wrote:   [X] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [ ] -1 I oppose this release because... Tested with Tomcat 10.1.x Mark

Re: [daemon] please add support for riscv64 arch

2022-05-04 Thread Mark Thomas
Done. Thanks for the patch. Mark On 04/05/2022 06:56, Bo YU wrote: Hi, Please add support for riscv64 arch. https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1010381;filename=riscv64.diff;msg=5 If you need me to do more tests on real riscv64 hardware, please let me know, Thank you.

[VOTE] Release Apache Commons Daemon 1.3.1 based on RC1

2022-05-03 Thread Mark Thomas
://www.apache.org/dist/commons/KEYS Please review the release candidate and vote. This vote will close no sooner than 72 hours from now. [ ] +1 Release these artifacts [ ] +0 OK, but... [ ] -0 OK, but really should fix... [ ] -1 I oppose this release because... Thank you, Mark Thomas

[DAEMON] Releasing 1.3.1 soon

2022-04-29 Thread Mark Thomas
Hi all, This is a heads up I'm planning a Daemon 1.3.1 release soon. I want to finish off the work on the log messages and then tag. I expect that will be either later today or early next week. Mark - To unsubscribe,

Re: [ALL] consider moving to a directory per release, rather than binaries and source

2022-03-16 Thread Mark Thomas
On 16/03/2022 17:53, sebb wrote: As the subject says. We currently use separate directories for binaries and source, each of which may contain multiple versions. This is a bit awkward to maintain compared with a directory per release which would contain both binaries and source. I think we

Re: [POOL] Archive pre-Java 7 versions?

2022-03-16 Thread Mark Thomas
On 16/03/2022 15:48, sebb wrote: As for DBCP, I wonder if there are likely to be any updates to the earlier versions of Pool? Seems unlikely. Mark - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional

[ANNOUNCEMENT] Commons Daemon 1.3.0 Released

2022-03-15 Thread Mark Thomas
The Apache Commons Team is pleased to announce the availability of Apache Commons Daemon 1.3.0. The Apache Commons Daemon software library provides a generic Daemon (unix) or Service (Windows) wrapper for Java code. Version 1.3.0 is a mainly bugfix release but also increases the minimum Java

[VOTE][RESULT] Release Apache Commons Daemon 1.3.0 based on RC1

2022-03-15 Thread Mark Thomas
The following votes were cast: Binding: +1: ggregory, markt, kinow No other votes were cast. The vote therefore passes. Thanks to everyone who contributed to this release. Mark On 11/03/2022 13:32, Mark Thomas wrote: Since the 1.2.4 release, the minimum Java version has been updated

Re: [VOTE] Release Apache Commons Daemon 1.3.0 based on RC1

2022-03-14 Thread Mark Thomas
On 11/03/2022 13:32, Mark Thomas wrote: Please review the release candidate and vote. This vote will close no sooner that 72 hours from now.   [X] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [ ] -1 I oppose this release because... Tested

Re: [VOTE] Release Apache Commons Daemon 1.3.0 based on RC1

2022-03-11 Thread Mark Thomas
-Dcommons.release.isDistModule=true -Prelease didn't complete cleanly but didn't appear to affect the release artifacts. I've now figured out that was due to MNG-7316 and I'll add an note to HOW-TO-RELEASE.txt for future reference. Mark Gary On Fri, Mar 11, 2022, 08:32 Mark Thomas wrote: Since the 1.2.4

[VOTE] Release Apache Commons Daemon 1.3.0 based on RC1

2022-03-11 Thread Mark Thomas
that 72 hours from now. [ ] +1 Release these artifacts [ ] +0 OK, but... [ ] -0 OK, but really should fix... [ ] -1 I oppose this release because... Thank you, Mark Thomas, Release Manager (using key 10C01C5A2F6059E7

[DAEMON] Tagging 1.3.0

2022-03-10 Thread Mark Thomas
Hi all, Just a heads up that I'm planning on tagging Daemon 1.3.0 soon - probably tomorrow. Mark - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org

Re: [commons-daemon] 02/02: Copyright year update to 2022

2022-02-25 Thread Mark Thomas
: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/commons-daemon.git commit af00cbc3095e1798b3122a48ffe0d0c9d43d035d Author: Mark Thomas AuthorDate: Thu Feb 24 18:09:33 2022 +

Re: [VOTE][CANCELLED] Release Apache Commons Daemon 1.2.5 based on RC1

2022-02-01 Thread Mark Thomas
This vote has been cancelled as the consensus is that the next version needs to be 1.30 rather than 1.2.5. Mark On 27/01/2022 22:29, Mark Thomas wrote: We have fixed a few bugs and added some enhancements since Apache Commons Daemon 1.2.4 was released, so I would like to release Apache

Re: [VOTE] Release Apache Commons Daemon 1.2.5 based on RC1

2022-01-31 Thread Mark Thomas
On 27/01/2022 22:29, Mark Thomas wrote: Please review the release candidate and vote. This vote will close no sooner than 72 hours from now.   [ ] +1 Release these artifacts   [ ] +0 OK, but...   [ ] -0 OK, but really should fix...   [X] -1 I oppose this release because... The minimum

Re: [VOTE] Release Apache Commons Daemon 1.2.5 based on RC1

2022-01-31 Thread Mark Thomas
he release process didn't create the structure for dist. Mark ? Gary On Thu, Jan 27, 2022, 17:29 Mark Thomas wrote: We have fixed a few bugs and added some enhancements since Apache Commons Daemon 1.2.4 was released, so I would like to release Apache Commons Daemon 1.2.5. Apache Comm

[VOTE] Release Apache Commons Daemon 1.2.5 based on RC1

2022-01-27 Thread Mark Thomas
We have fixed a few bugs and added some enhancements since Apache Commons Daemon 1.2.4 was released, so I would like to release Apache Commons Daemon 1.2.5. Apache Commons Daemon 1.2.5 RC1 is available for review here: https://dist.apache.org/repos/dist/dev/commons/daemon/1.2.5-RC1 (svn

Re: [commons-dbcp] branch master updated: Update MXBean for use of Duration with BasicDataSource

2022-01-05 Thread Mark Thomas
28eb33b is described below commit 28eb33b5b3551de2e630a4cb59dc3bc5506f8114 Author: Mark Thomas AuthorDate: Wed Jan 5 19:07:51 2022 + Update MXBean for use of Duration with BasicDataSource --- .../org/apache/commons/dbcp2/BasicDataSource.java | 7 ++ .../org/apache/commons/dbcp2

Re: can we get rid of dependabot?

2021-12-29 Thread Mark Thomas
On 29/12/2021 15:04, Gary Gregory wrote: On Wed, Dec 29, 2021 at 9:37 AM Rob Tompkins wrote: Why not just run dependabot weekly. We move slowly enough that weekly currently works. Until we can get more hands on the project, slower comms are indeed reasonable…right? I would be OK with it

Re: can we get rid of dependabot?

2021-12-28 Thread Mark Thomas
+1 And it isn't just the notifications an upgrade is available. The associated GitHub emails are just as much of a problem. The Versions Maven Plugin would be a much better solution to this problem. - Run it once as part of the pre-release process. - One commit to apply all pending updates. -

Re: [OGNL] Drop commons-ognl project

2021-11-25 Thread Mark Thomas
On 25/11/2021 08:21, Lukasz Lenart wrote: Hi, I wonder what do you think about dropping commons-ognl project? This was supposed to be the next major version (4.x) but there was no activity in the project for a long time. Also migrating all the changes from the previous Github version is rather

Re: [commons-dbcp] branch master updated: Trivial format fix. Use consistent formatting for all classes.

2021-09-02 Thread Mark Thomas
On 02/09/2021 16:16, Gary Gregory wrote: The space after the license is on purpose, it is NOT like a Javadoc comment, so I do not see why the change is needed. I add that space when it is missing! The code formatting was inconsistent. I went with what looked to be the majority format for

Re: [all] OSS Fuzz

2021-04-13 Thread Mark Thomas
On 13/04/2021 17:49, Stefan Bodewig wrote: Fabian has offered to set up OSS Fuzz for Compress. Given that the issues OSS Fuzz detects may or may not be security sensitive, I don't feel it would be a good idea to have the tool send reports to a public mailing list. Therefore I propose to

Re: [commons-daemon] 1.2.5 release?

2021-03-25 Thread Mark Thomas
On 25/03/2021 13:50, Mladen Turk wrote: On 25/03/2021 14:46, Mark Thomas wrote: On 25/03/2021 12:21, Mladen Turk wrote: I used to do releases couple of years back. Since 1.2.5 is mostly fixing procrun issues, I'll try to make that release. Is there some doc with new set of rules

Re: [commons-daemon] 1.2.5 release?

2021-03-25 Thread Mark Thomas
On 25/03/2021 12:21, Mladen Turk wrote: I used to do releases couple of years back. Since 1.2.5 is mostly fixing procrun issues, I'll try to make that release. Is there some doc with new set of rules for creating a release? HOW-TO-RELEASE.txt located in the root of the repository. You'll

Re: Fwd: [apache/commons-daemon] Fix for https://issues.apache.org/jira/browse/DAEMON-314 (#23)

2021-02-23 Thread Mark Thomas
On 23/02/2021 12:08, Gary Gregory wrote: > Hi Mark, > > May you review please? Nothing jumps out at me as wrong but I am no C coder. Mark > > -- Forwarded message - > From: Jean-Frederic Clere > Date: Tue, Feb 23, 2021, 04:05 > Subject: Re: [apache/commons-daemon] Fix for >

[ANNOUNCEMENT] Commons Daemon 1.2.4 Released

2021-01-22 Thread Mark Thomas
The Apache Commons Team is pleased to announce the availability of Apache Commons Daemon 1.2.3. The Apache Commons Daemon software library provides a generic Daemon (unix) or Service (Windows) wrapper for Java code. Version 1.2.4 is a bugfix release. A full list of changes can be found at

Re: [VOTE][RESULT] Release Apache Commons Daemon 1.2.4 based on RC2

2021-01-21 Thread Mark Thomas
The following votes were cast: Binding: +1: kinow, markt, chtompki, ggregory No other votes were cast. The vote therefore passes. Thanks to everyone who contributed toward this release. Mark - To unsubscribe, e-mail:

Re: [VOTE] Release Apache Commons Daemon 1.2.4 based on RC2

2021-01-20 Thread Mark Thomas
On 18/01/2021 17:12, Mark Thomas wrote: > We have fixed a couple of bugs and a regression in 1.2.3, so I would > like to release Apache Commons Daemon 1.2.4. > Please review the release candidate and vote. > This vote will close no sooner that 72 hours from now. > >

Re: [VOTE] Release Apache Commons Daemon 1.2.4 based on RC2

2021-01-18 Thread Mark Thomas
ted vote text. I obviously missed some. I'll add some more detailed notes to HOW-TO-RELEASE.txt for next time. Cheers, Mark > > Cheers > Bruno > > p.s.: I checked the NOTICE file because the commit message said 2012, but it > has the correct years now :) > > > O

[VOTE] Release Apache Commons Daemon 1.2.4 based on RC2

2021-01-18 Thread Mark Thomas
fix... [ ] -1 I oppose this release because... Thank you, Mark Thomas, Release Manager (using key 10C01C5A2F6059E7) - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h

[VOTE][RESULT] Apache Commons Daemon 1.2.4 based on RC1

2021-01-12 Thread Mark Thomas
Primarily because I forgot to sign the Windows binaries, I am cancelling the VOTE for this RC. I'm aiming to address this and the minor issues noted in the reviews of RC1 and have RC2 ready in the next day or so. Thanks, Mark On 06/01/2021 17:24, Mark Thomas wrote: > We have fixed a few b

Re: [VOTE] Apache Commons Daemon 1.2.4 based on RC1

2021-01-10 Thread Mark Thomas
ooking OK. Then looked at the signatures for the Maven > repository, also looking OK. Thanks for reviewing. Mark > > > Thanks!Bruno > > > On Thursday, 7 January 2021, 6:24:14 am NZDT, Mark Thomas > wrote: > > We have fixed a few bugs including a regres

[DAEMON] Using the commons release plugin

2021-01-06 Thread Mark Thomas
Hi, I've had a chance to look at the commons release plugin and daemon again - primarily as a way of generating the text for the VOTE email. The current Commons Daemon specific release guide is: https://github.com/apache/commons-daemon/blob/master/HOWTO-RELEASE.txt If, at the end of the Maven

[VOTE] Apache Commons Daemon 1.2.4 based on RC1

2021-01-06 Thread Mark Thomas
We have fixed a few bugs including a regression since Apache Commons Daemon 1.2.3 was released, so I would like to release Apache Commons Daemon 1.2.4. Apache Commons Daemon 1.2.4 RC1 is available for review here: https://dist.apache.org/repos/dist/dev/commons/daemon/1.2.4-RC1 (svn revision

Re: [Daemon] release 1.2.4?

2021-01-06 Thread Mark Thomas
FYI, I'm expecting to tag 1.2.4-RC1 and start the release process later today. Mark On 23/11/2020 12:45, Rob Tompkins wrote: > I see. Let me give that a whirl > >> On Nov 23, 2020, at 3:58 AM, Mark Thomas wrote: >> >> Rob, >> >> You shouldn't need to

Re: [LOGGING] Build errors

2020-11-30 Thread Mark Thomas
lt;https://github.com/rmannibucau> | > LinkedIn <https://www.linkedin.com/in/rmannibucau> | Book > <https://www.packtpub.com/application-development/java-ee-8-high-performance> > > > Le lun. 30 nov. 2020 à 10:09, Mark Thomas a écrit : > >> On 30/11/2020 08:50,

Re: [LOGGING] Build errors

2020-11-30 Thread Mark Thomas
https://www.packtpub.com/application-development/java-ee-8-high-performance> > > > Le lun. 30 nov. 2020 à 09:40, Mark Thomas a écrit : > >> Hi, >> >> I've stumbled across the following error when trying to build a clean >> clone of commons-logging with Maven 3.6

  1   2   3   4   5   6   7   8   >