Re: Re: [LANG] Support single quotes in DurationFormatUtils methods' formats

2024-05-30 Thread Gary D. Gregory
I'm OK with Sebb's solution [1] Any further thoughts here? Gary [1] https://github.com/apache/commons-lang/pull/1227 On 2024/05/29 13:37:40 Mike Drob wrote: > On Wed, May 29, 2024 at 8:17 AM Gary Gregory wrote: > > > (Sorry for the top post, phone) > > > > A case I can imagine an empty ''

Re: Javadoc usability

2024-05-26 Thread Gary D. Gregory
Emmanuel, It looks like you updated the Commons Parent POM to add a profile without documenting the change in changes.xml. Would you please do that? TY, Gary On 2024/05/18 12:21:54 sebb wrote: > If we are changing the Javadoc settings, we should update the footer > to include the full list of

Re: [VFS] Duplicate Listeners

2024-05-23 Thread Gary D. Gregory
Hi Bernd, Thank you for researching this issue and presenting your findings. In 2.9.0, we had (as you found): public static void installListener(final FileObject file, final FileListener listener) { final WeakRefFileListener weakListener = new WeakRefFileListener(file, listener);

Re: (commons-lang) 01/02: Deprecate SystemUtils.getUserName(String) in favor of SystemProperties.getUserName(Supplier)

2024-05-02 Thread Gary D. Gregory
is done elsewhere. - For example, SystemUtils gives you the 'user.home' string as a File belongs where it is now: File file = SystemUtils.getUserHome(). I don't think we need a User class for example. Gary On 2024/05/02 18:57:04 "Gary D. Gregory" wrote: > Hi Bernd, > > Soun

Re: (commons-lang) 01/02: Deprecate SystemUtils.getUserName(String) in favor of SystemProperties.getUserName(Supplier)

2024-05-02 Thread Gary D. Gregory
Hello Elliotte, OK, I'll use String defaults instead of Suppliers. Gary On 2024/05/02 16:48:48 Elliotte Rusty Harold wrote: > I'm OK with preferring SystemProperties though I'm not sure that > alpine justifies a new method and deprecation. > > I second the opinion that a literal string is

Re: (commons-lang) 01/02: Deprecate SystemUtils.getUserName(String) in favor of SystemProperties.getUserName(Supplier)

2024-05-02 Thread Gary D. Gregory
Hi Bernd, Sounds reasonable. I'll revert the deprecation and use String defaults instead of Suppliers. Gary On 2024/05/01 17:56:34 Bernd Eckenfels wrote: > Hi Gregory, > > What’s the idea behind that deprecation? The implementation is robust and > simple and easy to use. I would guess most

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc2

2024-04-30 Thread Gary D. Gregory
Ping to the PMC for this thread and the Commons CSV one ;-) Gary On 2024/04/29 07:16:26 Thomas Vandahl wrote: > Hi folks, > > > Am 20.04.2024 um 12:25 schrieb Thomas Vandahl : > > > > Hi folks, > > > > We have fixed a few bugs since Apache Commons JCS 3.2 was released, so I > > would like to

Re: [VOTE] Release Apache Commons CSV 1.11.0 based on RC1

2024-04-30 Thread Gary D. Gregory
My +1 Gary On 2024/04/28 22:24:13 Gary Gregory wrote: > We have fixed a few bugs and added enhancements (better Microsoft > Excel compatibility) since Apache Commons CSV 1.10.0 was released, so > I would like to release Apache Commons CSV 1.11.0. > > Apache Commons CSV 1.11.0 RC1 is available

Re: [Collections] Suppliers, Iterables, and Producers

2024-04-30 Thread Gary D. Gregory
On 2024/04/30 14:33:47 Alex Herbert wrote: > On Tue, 30 Apr 2024 at 14:45, Gary D. Gregory wrote: > > > Hi Claude, > > > > Thank you for the detailed reply :-) A few comments below. > > > > On 2024/04/30 06:29:38 Claude Warren wrote: > > > I wi

Re: [Collections] Suppliers, Iterables, and Producers

2024-04-30 Thread Gary D. Gregory
Hi Claude, Thank you for the detailed reply :-) A few comments below. On 2024/04/30 06:29:38 Claude Warren wrote: > I will see if I can clarify the javadocs and make things clearer. > > What I think I specifically heard is: > >- Be clear that producers are fast fail iterators with

Re: [CONFIGURATION] ParseException does not exist

2024-04-26 Thread Gary D. Gregory
Hello Ricardo, The build is green now: https://github.com/apache/commons-configuration/actions The error you found was just a temporary snafu ;-) Gary On 2024/04/24 18:01:24 Ricardo Mendes wrote: > Hey, > > Not sure if this is the right place to ask, but I just recently forked >

Re: [VOTE] Release Apache Commons BCEL 6.9.0 based on RC1

2024-04-25 Thread Gary D. Gregory
Ping :-) On 2024/04/22 18:48:21 Bruno Kinoshita wrote: > +1 > > Building OK from tag on > > Apache Maven 3.8.5 (3599d3414f046de2324203b78ddcf9b5e4388aa0) > Maven home: /opt/apache-maven-3.8.5 > Java version: 17.0.10, vendor: Private Build, runtime: > /usr/lib/jvm/java-17-openjdk-amd64 > Default

[Collections] Bloom filter package's Hasher to extend Function

2024-04-25 Thread Gary D. Gregory
Hi Clause, Albert, and all, Why not make Hasher more functional like so: public interface Hasher extends Function It would implement the standard `apply` instead of `indices`. WDYT? Gary - To unsubscribe, e-mail:

[ALL] GitHub is done with Java 8

2024-04-24 Thread Gary D. Gregory
Hi All, I just saw this on GitHub for our Lang component: Error: Could not find satisfied version for SemVer '8'. Available versions: 22.0.1+8, 22.0.0+36, 21.0.3+9.0.LTS, 21.0.2+13.0.LTS, 21.0.1+12.0.LTS, 21.0.0+35.0.LTS, 20.0.2+9, 20.0.1+9, 20.0.0+36, 19.0.2+7, 19.0.1+10, 19.0.0+36,

Re: [VOTE] Release Apache Commons BCEL 6.9.0 based on RC1

2024-04-22 Thread Gary D. Gregory
My +1 Gary On 2024/04/21 17:19:58 Gary Gregory wrote: > We have fixed a few bugs and one enhancement (Java 16 records) since > Apache Commons BCEL 6.8.2 was released, so I would like to release > Apache Commons BCEL 6.9.0. > > Apache Commons BCEL 6.9.0 RC1 is available for review here: >

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc2

2024-04-20 Thread Gary D. Gregory
Something is wrong with at least one ASC file: https://dist.apache.org/repos/dist/dev/commons/jcs/3.2.1-rc2/commons-jcs3-dist-3.2.1-src.zip.asc $ gpg --verify commons-jcs3-dist-3.2.1-src.zip.asc gpg: assuming signed data in 'commons-jcs3-dist-3.2.1-src.zip' gpg: Signature made Sat, Apr 20, 2024

Re: [jcs] multicast issues, was: Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-07 Thread Gary D. Gregory
On 2024/04/07 17:04:15 Thomas Vandahl wrote: > (trying to move this out of the vote thread) > > Hi Gary, > > > Am 07.04.2024 um 14:33 schrieb Gary D. Gregory : > > > > Hi Thomas, > > > > Ran: > > > > mvn test -Dtest=UDPDiscover

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-07 Thread Gary D. Gregory
Hi Thomas, Ran: mvn test -Dtest=UDPDiscoverySenderEncryptedUnitTest Log: https://paste.apache.org/1hmkb Gary On 2024/04/06 20:06:47 Thomas Vandahl wrote: > Hi Gary, > > > Am 06.04.2024 um 17:20 schrieb Gary D. Gregory : > > > > Switching to origin/release-3.2.1

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-06 Thread Gary D. Gregory
] UDPDiscoverySenderEncryptedUnitTest.testRequestBroadcast:157 message not received So that's one for the release notes! Gary On 2024/04/06 15:20:43 "Gary D. Gregory" wrote: > Ah, I was on git master on Windows, which without the VPN, now hangs in: > > [INFO] Running > o

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-06 Thread Gary D. Gregory
! Gary On 2024/04/06 14:57:50 Thomas Vandahl wrote: > Hi Gary, > > > Am 06.04.2024 um 15:07 schrieb Gary D. Gregory : > > > > mvn test -Dtest=UDPDiscoverySenderEncryptedUnitTest > > > > which failed with the log here: https://paste.apache.org/b4p09 > >

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-06 Thread Gary D. Gregory
java.util.logging.SimpleFormatter.format=[%1$tF %1$tT] %3$s [%4$-7s] %5$s %n and ran: mvn test -Dtest=UDPDiscoverySenderEncryptedUnitTest which failed with the log here: https://paste.apache.org/b4p09 TY, Gary On 2024/04/06 12:46:20 Thomas Vandahl wrote: > Hi Gary, > > > Am 06.04.2024 um 14:10 schrieb Gar

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-06 Thread Gary D. Gregory
m 17:28 schrieb Gary D. Gregory : > > > > [INFO] Running > > org.apache.commons.jcs3.utils.discovery.UDPDiscoverySenderEncryptedUnitTest > > [ERROR] Tests run: 3, Failures: 3, Errors: 0, Skipped: 0, Time elapsed: > > 9.526 s &

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-05 Thread Gary D. Gregory
Rob, What OS and such (mvn -version)? Gary On 2024/04/05 14:51:39 Rob Tompkins wrote: > -0.5: building with java17 from the src zip I get the following for the > jcs-core module > > [INFO] Results: > [INFO] > [ERROR] Failures: > [ERROR]

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-05 Thread Gary D. Gregory
pache.maven.surefire.booter.ForkedBooter.run(ForkedBooter.java:595) at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:581) Gary On 2024/04/05 13:51:39 Thomas Vandahl wrote: > Hi Gary, > > > Am 04.04.2024 um 22:30 schrieb Gary D. Gregory : > > > > After being successful on macOS, I am se

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-05 Thread Gary D. Gregory
FTR, on Linux running inside Windows (WSL), the build works for me using: Linux RS-PF3NRMLR 5.15.133.1-microsoft-standard-WSL2 #1 SMP Thu Oct 5 21:02:42 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae) Maven home:

Re: [VOTE] Release Apache Commons JCS 3.2.1 based on rc1

2024-04-04 Thread Gary D. Gregory
After being successful on macOS, I am seeing the following _repeatable_ failures on Windows 10 running the default Maven goal (just `mvn`): ... [INFO] Running org.apache.commons.jcs3.utils.discovery.UDPDiscoverySenderEncryptedUnitTest [ERROR] Tests run: 3, Failures: 3, Errors: 0, Skipped: 0,

Re: Interest in CollectionUtils feature

2024-03-20 Thread Gary D. Gregory
Oops, obviously: Stream.of(array).filter(e -> !e.isEmpty()).findFirst(); On 2024/03/20 13:18:49 Gary Gregory wrote: > Hello Marco, > > Good call coming to the mailing list first :-) > > There is a mismatch in concepts in the proposed API IMO. > > But I can't tell for sure since you don't

Re: [LANG] EqualsBuilder#reflectionEquals feature brainstorming

2024-03-07 Thread Gary D. Gregory
On 2024/03/07 06:58:30 Mark Struberg wrote: > The question to me is how we can make it more robust. > In a Collection (but actually also in most lists) the order in which you get > the values (Iterator or get(i)) is not deterministic. It can be different in > one list than in another - even if

Re: [VOTE] Release Apache Commons BCEL 6.8.2 based on RC1

2024-02-25 Thread Gary D. Gregory
This vote passes with the following +1 binding votes: - Gary Gregory - Bruno Kinoshita - Rob Tompkins Gary On 2024/02/24 17:31:30 Rob Tompkins wrote: > +1 > > > On Feb 21, 2024, at 7:18 PM, Gary D. Gregory wrote: > > > > We have fixed a few bugs since Apache Commons

Re: [VOTE] Release Apache Commons BCEL 6.8.2 based on RC1

2024-02-23 Thread Gary D. Gregory
My +1 Gary On 2024/02/22 00:18:35 "Gary D. Gregory" wrote: > We have fixed a few bugs since Apache Commons BCEL 6.8.1 was released, so I > would like to release Apache Commons BCEL 6.8.2. > > Apache Commons BCEL 6.8.2 RC1 is available for review here: > https://d

Re: commons-compress 1.26.0 optional dependency on commons-codec causes runtime failure.

2024-02-23 Thread Gary D. Gregory
On 2024/02/23 12:56:23 Elliotte Rusty Harold wrote: > On Thu, Feb 22, 2024 at 2:07 PM Romain Manni-Bucau > wrote: > > > +1 Elliotte > > ...plus the fact [io] is optional in the pom too which is not correct. > > Possibly commons-io used to be more legitimately optional, but since a > lot of

[VOTE] Release Apache Commons BCEL 6.8.2 based on RC1

2024-02-21 Thread Gary D. Gregory
We have fixed a few bugs since Apache Commons BCEL 6.8.1 was released, so I would like to release Apache Commons BCEL 6.8.2. Apache Commons BCEL 6.8.2 RC1 is available for review here: https://dist.apache.org/repos/dist/dev/commons/bcel/6.8.2-RC1 (svn revision 67482) The Git tag

Re: [RDF] Bump Java requirement from Java 8 to 11

2024-02-19 Thread Gary D. Gregory
A nice-to-have would be to port from JUnit 4 to 5. Gary On 2024/02/20 02:08:03 "Gary D. Gregory" wrote: > I bumped the Java version, the GitHub CI says Java 11 and 17 are OK but 21 > and 22-ea are not. > > See https://github.com/apache/commons-rdf/actions/runs/796748442

Re: [RDF] Bump Java requirement from Java 8 to 11

2024-02-19 Thread Gary D. Gregory
PRs will have to be rebased obviously. Gary On 2024/02/20 02:08:03 "Gary D. Gregory" wrote: > I bumped the Java version, the GitHub CI says Java 11 and 17 are OK but 21 > and 22-ea are not. > > See https://github.com/apache/commons-rdf/actions/runs/7967484426 > >

Re: [RDF] Bump Java requirement from Java 8 to 11

2024-02-19 Thread Gary D. Gregory
I bumped the Java version, the GitHub CI says Java 11 and 17 are OK but 21 and 22-ea are not. See https://github.com/apache/commons-rdf/actions/runs/7967484426 I think we need to address Java 21 before anything else. Help wanted ;-) Gary On 2024/02/19 07:29:49 Bruno Kinoshita wrote: > +1 >

Re: [VOTE] Release Apache Commons Codec 1.16.1 based on RC1

2024-02-08 Thread Gary D. Gregory
My +1 Gary On 2024/02/06 18:48:12 Rob Tompkins wrote: > +1 all looks good. > > Keep up the good work Gary!!! > > Cheers, > -Rob > > > On Feb 4, 2024, at 10:40 AM, Gary Gregory wrote: > > > > We have fixed a few bugs and added some enhancements since Apache > > Commons Codec 1.16.0 was

[COMPRESS] Decompress BZIP2 File Max Output is 900000 chars

2024-01-31 Thread Gary D. Gregory
Hi All, If anyone is looking for an issue to investigate: [COMPRESS-651] Decompress BZIP2 File Max Output is 90 chars https://issues.apache.org/jira/browse/COMPRESS-651 Gary - To unsubscribe, e-mail:

Re: Security model for Commons Imaging, Compress, Codec and IO: RCE and DOS?

2023-12-14 Thread Gary D. Gregory
Thank you Arnout for starting this thread. I think it's going to be hard to come up with a sensible statement for all 20+ Commons components without categorizing them (some higher/lower level classification) even though this thread only refers to four components. We can make some general

[COMPRESS] Optimize the nameMap of ZipFile #378

2023-11-28 Thread Gary D. Gregory
Hi All, I'd like community feedback on whether it is OK to merge https://github.com/apache/commons-compress/pull/378 TY! Gary - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail:

Re: [VALIDATOR] - Release of newer version of validator without OWASP vulnerabilities

2023-11-28 Thread Gary D. Gregory
Henrique, I should also ask: If you look at git master, is there anything you see that needs updating? TY! Gary On 2023/11/23 02:31:26 Henrique Siqueira Santos wrote: > I was wondering how the updates for some of the apache commons libraries work > in regards to the vulnerabilities of

Re: [lang] RandomStringUtilsTest.testRandomStringUtilsHomog fails a lot

2023-10-20 Thread Gary D. Gregory
Hi Alex, I'd prefer if you could give a shot at adjusting this test when you can take the time. TY, Gary On 2023/10/20 18:17:35 Alex Herbert wrote: > On Fri, 20 Oct 2023 at 18:55, Alex Herbert wrote: > > > > The chi-square critical value (13.82) is correct: > > > > >>> from scipy.stats import

[lang] RandomStringUtilsTest.testRandomStringUtilsHomog fails a lot

2023-10-20 Thread Gary D. Gregory
Despite the failure comment: RandomStringUtilsTest.testRandomStringUtilsHomog:474 test homogeneity -- will fail about 1 in 1000 times ==> expected: but was: This test fails a LOT more than once every 1000 times, based on how many GitHub builds I need to restart every week. What can be done

[BeanUtils] Java 21 failure converting time and timestamps

2023-10-20 Thread Gary D. Gregory
It seems that on top of our double trouble with [text], we have run into another conversion issue with Java 21, this time in [BeanUtils]. I'd like help figuring this one out: Error: org.apache.commons.beanutils2.sql.converters.SqlTimeConverterTestCase.testLocale -- Time elapsed: 0.009 s <<<

CVE-2023-42503: Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

2023-09-13 Thread Gary D. Gregory
Severity: moderate Affected versions: - Apache Commons Compress 1.22 before 1.24.0 Description: Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are

Re: [Codec] clearing input byte array vs not

2023-08-09 Thread Gary D. Gregory
Done and done in git master. Next, is how to document or change org.apache.commons.codec.digest.Crypt.crypt(byte[], String): The method clears the input byte array for all input types _except_ when calling UnixCrypt [1]. I could: (1) Document the inconsistency (right now, I left it unsaid)

[IMAGING] Logging vs Throwing exceptions

2023-05-09 Thread Gary D. Gregory
Hi All, The method org.apache.commons.imaging.icc.IccProfileParser.getICCProfileInfo(ByteSource) looks like: public IccProfileInfo getICCProfileInfo(final ByteSource byteSource) { // TODO Throw instead of logging? final IccProfileInfo result; try (InputStream is =

Re: [VOTE] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-06 Thread Gary D. Gregory
FYI I seem to be building fine for me using "Microsoft (R) C/C++ Optimizing Compiler Version 19.35.32217.1 for x64" but maybe there is a gotcha I am missing? Gary On 2023/05/06 15:12:56 "Gary D. Gregory" wrote: > Note a blocker but I imagine not true for this rel

Re: [VOTE] Release Apache Commons Daemon 1.3.4 based on RC1

2023-05-06 Thread Gary D. Gregory
Note a blocker but I imagine not true for this release: In the README.txt for the Windows native apps: "Release builds are build with Mladen Turk's (mturk) Custom Microsoft Compiler Toolkit Compilation. This can be obtained from: https://github.com/mturk/cmsc Version: 15.0.44" Is this true for

Re: [VOTE] Release Apache Commons IO 2.12.0 based on RC1

2023-05-03 Thread Gary D. Gregory
ree that none of these are likely blockers on their own but taken together the code base can be made significantly better. What put it over the edge for me is that new code that did not use builders should, and implementing this later would then cause deprecation of code we just introduced. TY! Gary

[IO] Deprecating Serialization

2023-05-02 Thread Gary D. Gregory
As we did for Apache Commons CVS, I plan on deprecating Serialization in Apache Commons IO for the usual "Item 85" [1] reasons focusing on security. I will add the following comment to classes that implement Serializable: * Deprecating Serialization * * Serialization is deprecated and will

Re: [VOTE] Release Apache Commons IO 2.12.0 based on RC1

2023-05-01 Thread Gary D. Gregory
Get we get more reviews, please? TY! Gary On 2023/04/29 22:01:52 Bruno Kinoshita wrote: > +1 > > Build from tag passed with no errors on > > Apache Maven 3.8.5 (3599d3414f046de2324203b78ddcf9b5e4388aa0) > Maven home: /opt/apache-maven-3.8.5 > Java version: 17.0.6, vendor: Private Build,

Re: [IO] IO-769: FileUtils copyDirectory() should not use COPY_ATTRIBUTES #377

2023-04-18 Thread Gary D. Gregory
Merged https://github.com/apache/commons-io/pull/377, see the PR for behavior. For the upcoming 2.12.0, COPY_ATTRIBUTES is no longer used by default. Gary On 2023/04/17 12:27:09 Gary Gregory wrote: > Hi All, > > I would like to get some ideas and consensus on how to proceed with >

[BCEL] https://github.com/apache/commons-bcel/pull/177

2023-04-10 Thread Gary D. Gregory
Mark and all, Any thoughts on https://github.com/apache/commons-bcel/pull/177 ? Gary - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org

[JEXL] Compatibility bug?

2023-04-07 Thread Gary D. Gregory
Hi All Did we create a bug in the recently released 3.3 which surfaces as https://github.com/apache/commons-scxml/pull/121 ? Gary - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail:

[math] The build is broken

2023-03-04 Thread Gary D. Gregory
Hi Math, The build is broken locally for me, and as exemplified on GHA [1]: https://github.com/apache/commons-math/actions/runs/4086106809/jobs/7044975362 Please fix. Gary [1] https://github.com/apache/commons-math/actions -

[POOL] GenericKeyedObjectPool.clear(K) vs clear()

2023-03-01 Thread Gary D. Gregory
Hi All, Looking at org.apache.commons.pool2.impl.GenericKeyedObjectPool.clear(K) and clear(), I am wondering why the former calls clear(K, boolean) with true while the latter calls it with false. Surely both should call clear(K, boolean) with the same value. Any ideas? Gary

[lang] excluding fields in ReflectionDiffBuilder

2023-02-11 Thread Gary D. Gregory
Hi All: I'd like another set of eyes on https://github.com/apache/commons-lang/pull/838 Is this one OK merge? Gary - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail:

Re: [VOTE] Release Apache Commons Parent 56 based on RC1

2022-12-30 Thread Gary D. Gregory
I forgot to say this is a LAZY VOTE. Gary On 2022/12/30 16:27:22 Gary Gregory wrote: > We have added some enhancements since Apache Commons Parent 55 was > released, so I would like to release Apache Commons Parent 56. > > Apache Commons Parent 56 RC1 is available for review here: >

[REPORT] Board report for this quarter

2022-12-15 Thread Gary D. Gregory
This is what I submitted for our board report for this quarter: ## Description: The mission of Apache Commons is the creation and maintenance of Java focused reusable libraries and components ## Issues: There are no issues requiring board attention. ## Membership Data: Apache Commons was

Re: [VOTE][LAZY] Release Apache Commons Parent 55 based on RC1

2022-12-08 Thread Gary D. Gregory
Hi Alex, Thank you for your review. I cannot reproduce your error. I tested locally now with commons-parent git master 55-SNAPSHOT with commons-text (the component I tested for the RC), commons-lang, and commons-rng. For 'mvn install -DskipTests', I see output like: ... [INFO] <<<

CVE-2021-37533: Apache Commons Net's FTP client trusts the host from PASV response by default

2022-12-03 Thread Gary D. Gregory
Severity: low Description: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to

Re: [VOTE] Release Apache Commons Net 3.9.0 based on RC1

2022-12-01 Thread Gary D. Gregory
We need more reviews please. Gary On 2022/11/29 21:32:31 Gary Gregory wrote: > Ping ;-) > > Gary > > On Sat, Nov 26, 2022, 22:02 Gary Gregory wrote: > > > We have fixed quite a few bugs and added some enhancements since Apache > > Commons Net 3.8.0 was released, so I would like to release

Re: [VOTE] Release Apache Commons Net 3.9.0 based on RC1

2022-12-01 Thread Gary D. Gregory
We need more reviews please. Gary On 2022/11/29 21:32:31 Gary Gregory wrote: > Ping ;-) > > Gary > > On Sat, Nov 26, 2022, 22:02 Gary Gregory wrote: > > > We have fixed quite a few bugs and added some enhancements since Apache > > Commons Net 3.8.0 was released, so I would like to release

Re: [VOTE] Release Apache Commons Daemon 1.3.3 based on RC1

2022-11-23 Thread Gary D. Gregory
Testing src zip: ASC, SHA, Apache RAT, Maven default goal, JApiCmp, all OK on: Apache Maven 3.8.6 (84538c9988a25aec085021c365c560670ad80f63) Maven home: C:\java\apache-maven-3.8.6 Java version: 1.8.0_352, vendor: Temurin, runtime: C:\Program Files\Eclipse Adoptium\jdk-8.0.352.8-hotspot\jre

Re: [commons-bcel] branch master updated: Validate the u4 length of all attributes

2022-11-22 Thread Gary D. Gregory
I am concerned that the recent fixes we've made through OSS fuzz and code inspection to validate input are semantically incorrect: The verifier should catch these errors, not the construction of Java objects. This could be a case where fuzzing and low-level code inspections only appear to find

Re: [commons-bcel] branch master updated: Unknown attributes with invalid length now trigger ClassFormatException

2022-11-21 Thread Gary D. Gregory
Hm, after reading https://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html#jvms-4.7 I will pull up the validation. TY for the commit :-) Gary On 2022/11/21 12:00:20 Gary Gregory wrote: > Hi Mark, > > Any reason not to do this check in the Attribute superclass? > > Gaty > > On Mon,

Re: [BCEL] Invalid test or bug?

2022-11-19 Thread Gary D. Gregory
> > Gary > > On Thu, Nov 17, 2022 at 10:53 AM Mark Roberts > wrote: > > > > I will try to take a look at this later today. > > > > Mark > > > > -Original Message- > > From: Gary D. Gregory [mailto:ggreg...@apache.org] > > Sent: Thu

Re: [BCEL] Invalid test or bug?

2022-11-17 Thread Gary D. Gregory
More specifically, javap says: 21: invokevirtual #68 // Method "[B".clone:()Ljava/lang/Object; So calling a method on an array with invokevirtual is ok and we have a bug. Thoughts? Gary On 2022/11/17 14:45:41 "Gary D. Gregory" wrote: > Hm, I'm

Re: [BCEL] Invalid test or bug?

2022-11-17 Thread Gary D. Gregory
Hm, I'm thinking bug when I see javap output like: #68 = Methodref #901.#902// "[B".clone:()Ljava/lang/Object; Thoughts? Gary On 2022/11/17 13:04:32 "Gary D. Gregory" wrote: > Actually: VerifyJavaMathTestCase and VerifyJavaUtilTestCase > > Gar

Re: [BCEL] Invalid test or bug?

2022-11-17 Thread Gary D. Gregory
Actually: VerifyJavaMathTestCase and VerifyJavaUtilTestCase Gary On 2022/11/17 13:00:21 "Gary D. Gregory" wrote: > Hi All & Mark Roberts: > > I added JavaMathTestCase as a disabled test as it fails. > > Is this a legal test to try o

[BCEL] Invalid test or bug?

2022-11-17 Thread Gary D. Gregory
Hi All & Mark Roberts: I added JavaMathTestCase as a disabled test as it fails. Is this a legal test to try or do we have a bug? Gary - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands,

Re: [BCEL] low test coverage

2022-11-08 Thread Gary D. Gregory
Hello All, Recent PRs have brought up the coverage to 52% as you can see from the badge on https://github.com/apache/commons-bcel pointing to https://app.codecov.io/gh/apache/commons-bcel/tree/master Thank you to those who pitched in. You can also run 'mvn clean package site' locally and

[collections] Using known concepts

2022-11-06 Thread Gary D. Gregory
We have: org.apache.commons.collections4.bloomfilter.HasherCollection.add(Collection) I propose that we rename it to "addAll" to follow existing Java concepts in Collections. Gary - To unsubscribe, e-mail:

CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

2022-11-04 Thread Gary D. Gregory
Description: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass

RE: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC2

2022-11-02 Thread Gary D. Gregory
My +1 Gary On 2022/11/02 18:58:26 "Gary D. Gregory" wrote: > On 2022/11/02 16:41:30 Mark Roberts wrote: > > In the constructor of > > /src/main/java/org/apache/bcel/verifier/structurals/ExceptionHandlers.java - > > the 'computeIfAbsent' line is duplicated.

RE: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC2

2022-11-02 Thread Gary D. Gregory
the 2nd invocation); I'll fix it post-release. Gary > > Mark > > -Original Message- > From: Gary D. Gregory [mailto:ggreg...@apache.org] > Sent: Tuesday, November 1, 2022 10:17 AM > To: dev@commons.apache.org > Subject: Re: [VOTE] Release Apache Commons

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC2

2022-11-02 Thread Gary D. Gregory
I updated git master for consistency to use the URL that does not redirect. On 2022/11/02 14:42:05 "Gary D. Gregory" wrote: > Note that https://commons.apache.org/bcel redirects to > https://commons.apache.org/proper/commons-bcel > > On 2022/11/02 14:15:44 Alex Herber

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC2

2022-11-02 Thread Gary D. Gregory
Note that https://commons.apache.org/bcel redirects to https://commons.apache.org/proper/commons-bcel On 2022/11/02 14:15:44 Alex Herbert wrote: > Validated signatures using > > svn co https://dist.apache.org/repos/dist/dev/commons/bcel/6.6.1-RC2 > cd 6.6.1-RC2/ > chmod +x

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC2

2022-11-02 Thread Gary D. Gregory
Thank you for the review, my comments are inline below. On 2022/11/02 14:15:44 Alex Herbert wrote: > Validated signatures using > > svn co https://dist.apache.org/repos/dist/dev/commons/bcel/6.6.1-RC2 > cd 6.6.1-RC2/ > chmod +x signature-validator.sh > ./signature-validator.sh >

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC2

2022-11-02 Thread Gary D. Gregory
pong? On 2022/11/01 17:16:57 "Gary D. Gregory" wrote: > ping :-) > > On 2022/10/29 16:35:28 Gary Gregory wrote: > > We have fixed a regression bug since Apache Commons BCEL 6.6.0 was > > released, so I would like to release Apache Commons BCEL 6.6.1. > &g

Re: ENMT VALIDATION RESULTS

2022-11-01 Thread Gary D. Gregory
It seems to me the first step would be to contact whomever wrote org.onap.portalsdk.analytics.model.runtime.ReportRuntime Gary On 2022/11/01 23:46:17 Scott Short wrote: > Hello, > > I received the following error when trying to view Validation Results in > ENMT. Please advise. > > > > >

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC2

2022-11-01 Thread Gary D. Gregory
ping :-) On 2022/10/29 16:35:28 Gary Gregory wrote: > We have fixed a regression bug since Apache Commons BCEL 6.6.0 was > released, so I would like to release Apache Commons BCEL 6.6.1. > > Apache Commons BCEL 6.6.1 RC2 is available for review here: >

Re: [numbers] Erronous tag NUMBERS_1_0_B1_RC1

2022-10-30 Thread Gary D. Gregory
There better never be RC tags under the rel/ prefix, that space is only for releases and lives forever. Gary On 2022/10/28 16:38:24 Alex Herbert wrote: > When preparing the 1.1 RC for [numbers] I pushed my tags using: > > git push --tags > > This seems to have pushed an old tag

Re: [VOTE] Release Apache Commons Compress 1.22 based on RC1

2022-10-30 Thread Gary D. Gregory
What is happening with this vote thread? Gary On 2022/10/28 20:02:21 Bruno Kinoshita wrote: > Hi Matt, > > [x] +1 Release these artifacts > > Thanks for confirming the tag name. > > Build passing successfully using that tag, running `mvn clean test install > site` on > > nothing to commit,

Re: [VOTE] Release Apache Commons Compress 1.22 based on RC1

2022-10-28 Thread Gary D. Gregory
The tag in the repo is wrong: git clone https://gitbox.apache.org/repos/asf/commons-compress.git --branch commons-compress-1.22-RC1 commons-compress-1.22-RC1 Cloning into 'commons-compress-1.22-RC1'... fatal: Remote branch commons-compress-1.22-RC1 not found in upstream origin Gary On

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-27 Thread Gary D. Gregory
Thanks Alex. I'll see what I can clean up this weekend before RC2 unless someone else can get to it. Gary On 2022/10/26 16:31:00 Alex Herbert wrote: > Validated signatures on the binary and src distributions. > > Built from src.zip using: > > maven install site -P jacoco -P japicmp > >

[VOTE][CANCEL] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-27 Thread Gary D. Gregory
g list and constant_pool in the > body. constant_pool is class field and I don’t think the intention of copy_ > is to reuse the existing ConstantPool. > > Mark > > > -Original Message----- > From: Gary D. Gregory [mailto:ggreg...@apache.org] > Sent: Tuesday, October 25, 2022 4:3

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-26 Thread Gary D. Gregory
Ping ;-) On 2022/10/23 14:58:05 Gary Gregory wrote: > We have fixed one bug since Apache Commons BCEL 6.6.0 was released, so > I would like to release Apache Commons BCEL 6.6.1. This will help > SpotBugs migrate from 6.5.0. > > Apache Commons BCEL 6.6.1 RC1 is available for review here: >

Re: [VOTE] Release Apache Commons BCEL 6.6.1 based on RC1

2022-10-25 Thread Gary D. Gregory
Ping ;-) On 2022/10/23 14:58:05 Gary Gregory wrote: > We have fixed one bug since Apache Commons BCEL 6.6.0 was released, so > I would like to release Apache Commons BCEL 6.6.1. This will help > SpotBugs migrate from 6.5.0. > > Apache Commons BCEL 6.6.1 RC1 is available for review here: >

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-23 Thread Gary D. Gregory
Hi All, Alex, more below: On 2022/10/22 21:23:13 Alex Herbert wrote: > On Sat, 22 Oct 2022 at 20:05, Gary D. Gregory wrote: > > > > Thank you for the new tests Alex! > > > > Here is one area that is easy to overlook: As Commons CSV has evolved, _not > > all set

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-22 Thread Gary D. Gregory
ex Herbert wrote: > On Sat, 22 Oct 2022 at 13:56, Gary D. Gregory wrote: > > > > Thank you for your excellent investigation, Alex, and for finding and > > fixing the missing Test annotations. Overall, we have 98% coverage. > > :) > > > Taking stock, I think th

[CANCEL][VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-22 Thread Gary D. Gregory
This VOTE is canceled. I will roll an RC2 if we agree that git master is OK. Gary On 2022/10/22 12:56:40 "Gary D. Gregory" wrote: > Thank you for your excellent investigation, Alex, and for finding and fixing > the missing Test annotations. Overall, we have 98% coverage. >

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-22 Thread Gary D. Gregory
> > fine > > > with closing my pr. > > > > > > regards, > > > Markus > > > > > > > > > From: Gary Gregory > > > Sent: Friday, October 21, 2022 15:17 > > > To: Commons Developers List > > > Subject: Re: [VOTE] Rel

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-21 Thread Gary D. Gregory
On 2022/10/20 22:56:05 Alex Herbert wrote: > On Thu, 20 Oct 2022 at 23:43, Alex Herbert wrote: > > > > I did not have time to track through whether this behaviour changed > > after the initial implementation of the flag. I would think not as the > > original behaviour is from 1.0. This would map

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-21 Thread Gary D. Gregory
; Would't it be simpler to deal with the serialization issue by bumping the > > serialVersionID? We can just say that you only serialized and deserialize > > for the same version. Also note the PR will throw an NPE in the builder > > when instead of using the validate() method. >

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-20 Thread Gary D. Gregory
Hi All (below) On 2022/10/20 18:08:31 Alex Herbert wrote: > On Thu, 20 Oct 2022 at 17:05, sebb wrote: > > > > On Thu, 20 Oct 2022 at 15:43, Gary Gregory wrote: > > > > > > Would't it be simpler to deal with the serialization issue by bumping the > > > serialVersionID? We can just say that you

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
I've commented on the PR. TY. Gary On 2022/10/19 16:51:57 Gary Gregory wrote: > On Wed, Oct 19, 2022 at 10:01 AM Alex Herbert > wrote: > > > > On Wed, 19 Oct 2022 at 14:57, Gary D. Gregory wrote: > > > > > > My +1 > > > > > > Gary

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
Hi Markus, Anyone can vote, please see https://www.apache.org/foundation/voting.html Note that PMC member votes are binding, while others are advisory. Gary On 2022/10/17 10:00:13 sma...@outlook.de wrote: > Hello > > CSV-264 (Add DuplicateHeaderMode) introduces bugs that should be fixed

Re: [VOTE] Release Apache Commons CSV 1.10.0 based on RC1

2022-10-19 Thread Gary D. Gregory
My +1 Gary On 2022/10/16 12:48:50 Gary Gregory wrote: > To: dev@commons.apache.org > We have fixed a few bugs and added some enhancements since Apache > Commons CSV 1.9.0 was released, so I would like to release Apache > Commons CSV 1.10.0. > > Apache Commons CSV 1.10.0 RC1 is available for

CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

2022-10-13 Thread Gary D. Gregory
Severity: important Description: Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of

  1   2   >