Using: mvn verify -Prelease artifact:compare -Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1309
(Should' we also say "clean"?) I get: [INFO] --- artifact:3.5.1:compare (default-cli) @ log4j-bom --- [WARNING] <project.build.outputTimestamp> property is inherited, it should be defined in pom.xml Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1309/org/apache/logging/log4j/log4j-bom/2.24.3/log4j-bom-2.24.3.buildinfo [INFO] Reference buildinfo file not found: it will be generated from downloaded reference artifacts Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1309/org/apache/logging/log4j/log4j-bom/2.24.3/log4j-bom-2.24.3.pom Downloaded from reference: https://repository.apache.org/content/repositories/orgapachelogging-1309/org/apache/logging/log4j/log4j-bom/2.24.3/log4j-bom-2.24.3.pom (12 kB at 86 kB/s) Downloading from reference: https://repository.apache.org/content/repositories/orgapachelogging-1309/org/apache/logging/log4j/log4j-bom/2.24.3/log4j-bom-2.24.3-cyclonedx.xml Downloaded from reference: https://repository.apache.org/content/repositories/orgapachelogging-1309/org/apache/logging/log4j/log4j-bom/2.24.3/log4j-bom-2.24.3-cyclonedx.xml (416 kB at 613 kB/s) [INFO] Minimal buildinfo generated from downloaded artifacts: /Users/garydgregory/rc/log4j-2.24.3/src/target/reference/log4j-bom-2.24.3.buildinfo [ERROR] sha512 mismatch log4j-bom-2.24.3-cyclonedx.xml: investigate with diffoscope target/reference/org.apache.logging.log4j/log4j-bom-2.24.3-cyclonedx.xml target/bom.xml [ERROR] Reproducible Build output summary: 1 files ok, 1 different [ERROR] see diff target/reference/log4j-bom-2.24.3.buildinfo target/log4j-bom-2.24.3.buildinfo [ERROR] see also https://maven.apache.org/guides/mini/guide-reproducible-builds.html [INFO] Reproducible Build output comparison saved to /Users/garydgregory/rc/log4j-2.24.3/src/target/log4j-bom-2.24.3.buildcompare [INFO] Aggregate buildcompare copied to /Users/garydgregory/rc/log4j-2.24.3/src/target/log4j-bom-2.24.3.buildcompare [INFO] ------------------------------------------------------------------------ Any ideas? TY, Gary On Tue, Dec 10, 2024 at 7:23 AM Gary Gregory <garydgreg...@gmail.com> wrote: > > I'm following the review kit and I get: > > sh mvnw verify \ > -Prelease artifact:compare \ > > -Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1309 > Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper > might be compromised. > Investigate or delete > /Users/garydgregory/rc/log4j-2.24.3/src/.mvn/wrapper/maven-wrapper.jar > to attempt a clean download. > If you updated your Maven version, you need to update the specified > wrapperSha256Sum property. > zsh: no such file or directory: > -Dreference.repo=https://repository.apache.org/content/repositories/orgapachelogging-1309 > > which is exactly why I don't use or recommend using baking in build > wrappers... > > Gary > > > > > On Tue, Dec 10, 2024 at 6:31 AM Piotr P. Karwasz > > <pi...@mailing.copernik.eu> wrote: > > > > > > This is a vote to release the Apache Log4j `2.24.3`. > > > > > > Website: https://logging.staged.apache.org/log4j/2.24.3/index.html > > > GitHub: https://github.com/apache/logging-log4j2 > > > Commit: 4aa5efec7f2ee2d4623381cd66c3df3a16a6b9a9 > > > Distribution: https://dist.apache.org/repos/dist/dev/logging/log4j/2.24.3 > > > Nexus: > > > https://repository.apache.org/content/repositories/orgapachelogging-1309 > > > Signing key: 0x077e8893a6dcc33dd4a4d5b256e73ba9a0b592d0 > > > Review kit: > > > https://logging.apache.org/logging-parent/release-review-instructions.html > > > > > > Please download, test, and cast your votes on this mailing list. > > > > > > [ ] +1, release the artifacts > > > [ ] -1, don't release, because... > > > > > > This vote is open for 72 hours and will pass unless getting a > > > net negative vote count. All votes are welcome and we encourage > > > everyone to test the release, but only the Logging Services PMC > > > votes are officially counted. At least 3 +1 votes and more > > > positive than negative votes are required. > > > > > > == Release Notes > > > > > > This release fixes two minor bugs. > > > > > > === Fixed > > > > > > * Fix `ConcurrentModificationException`, if multiple threads modify > > > loggers > > > concurrently. This bug affects users that modify logger levels > > > programmatically. (#3234) > > > * Protects `PropertiesUtil` against property sources that call > > > `PropertiesUtil` recursively. In some cases such a property source > > > can even > > > cause deadlocks. (#3252) > > > > > > Piotr > > >
