Vladimir, wouldn't a more efficient approach be to offer support to
Logging Services then have them make a release to address the recent CVE
while still maintaining 1.2.17 compatibility? I don't get the sense
folks are against fixing things. Re-starting the entire EOL'ed Log4j1
engine with a new crew to fix one issue is confusing. To answer your
question about sponsorship, I want to explore partnering with Logging
Services before forming a new Log4j1 team.
On 12/20/2021 11:15 AM, Gary Gregory wrote:
I don't see the need for the incubator or a new PMC, this is a recipe for
confusion for users and contributors: Log4j 1 is a component of the Apache
Logging Services project and should remain for Apache to provide the best
and consistent *story* for Java logging, at Apache at least.
Things are bad enough when a product or projects offers pluggable logging
and I have have to explain facades like Log4j API, Jetty Logging, slf4j,
etc, and then implementations of APIs like Log4j Core, Logback, etc, and
then explain when and how to use bridges.
I wrote the above to make the point that reintroducing log4j 1 as a first
class citizen is going to make an even bigger and confusing mess.
The only work we should allow is a 1.2.x release that fixes CVEs.
We should continue to evangelize migration to 2.x.
Gary
On Mon, Dec 20, 2021, 09:36 Ralph Goers <[email protected]> wrote:
I am sure any number of PMC members would be happy to act as sponsors &
mentors. However, before
you even start you need to know if you have enough people who want to
participate tin the project. The
application form needs to include the list of names of people who will
become the initial members of the project.
The reason I brought this up is that it seems there are two groups here.
One that wants to get a release
out and then put Log4j 1 back in the coffin and another that wants to
resurrect it.
Ralph
On Dec 20, 2021, at 7:06 AM, Vladimir Sitnikov <
[email protected]> wrote:
Ron,
There's a need to move log4j 1.x forward, and Ralph Goers suggested
that the way to go is to re-incubate it, see [1].
Could you sponsor the project or do you want Incubator to do that? (see
[2])
[1]: https://lists.apache.org/thread/mlpb9v15r8qzpc58xnjn99r6tf9yy0p5
[2]: https://lists.apache.org/thread/c2362g4m4m4y1n7zl444ncvhmfb9oy0m
Vladimir
