Re: New Log4j 1 repo

2021-12-23 Thread Gary Gregory
Cute :-) But... Over at Apache Commons, we just dropped all trunk branches a long time ago. No renames, it's simpler IMO. Gary On Thu, Dec 23, 2021 at 9:57 AM Ralph Goers wrote: > I am planning on creating a branch off the 1.2.17 tag. That branch will be > named main. > I will make that the

Re: New Log4j 1 repo

2021-12-23 Thread Ralph Goers
I am planning on creating a branch off the 1.2.17 tag. That branch will be named main. I will make that the default branch. Then I plan to rename trunk to a nice name like DEAD-HEAD (GRATEFUL) Ralph > On Dec 23, 2021, at 7:20 AM, Gary Gregory wrote: > > A name like "version" should only be

Re: New Log4j 1 repo

2021-12-23 Thread Gary Gregory
A name like "version" should only be for tags. Once a version is released, it does not make sense to have a branch by that name, but it would be OK to have a name for a "maintenance line", as we did with "2.12.x", so here we would have "1.2.x" which is lame IMO because we're ONLY EVER going to

Re: New Log4j 1 repo

2021-12-23 Thread Gary Gregory
WAIT, what? That does not make sense, it's the same bad name we ended up in with the "2.12" branch instead of "2.12.x". Gary On Thu, Dec 23, 2021 at 8:50 AM Apache wrote: > I was already asked to create a branch off of 1.2.17. It will become the > main branch so trunk can be left alone. > >

Re: New Log4j 1 repo

2021-12-23 Thread Gary Gregory
On Thu, Dec 23, 2021 at 8:43 AM Carter Kozak wrote: > I’d rather use a name like ‘main’ or ‘develop’ for inclusivity (across all > our projects). > We use 'develop' and 'master' w/i the same repos at work so that would not help my brain :-) but I am OK changing the name to something else than

Re: New Log4j 1 repo

2021-12-23 Thread Apache
I have VMWare on my Mac with both Ubuntu and Windows 10. So I should be able to run a build. Ralph > On Dec 23, 2021, at 5:59 AM, Christian Grobmeier wrote: > > Hi, > > > On Thu, Dec 23, 2021, at 13:33, Vladimir Sitnikov wrote: >>> using maven toolchain feature >> >> Are toolchains really

Re: New Log4j 1 repo

2021-12-23 Thread Apache
I was already asked to create a branch off of 1.2.17. It will become the main branch so trunk can be left alone. Ralph > On Dec 23, 2021, at 6:41 AM, Gary Gregory wrote: > > If we use this repo, is everyone OK renaming "trunk" to "master" in order > to match the branch name of our other

Re: New Log4j 1 repo

2021-12-23 Thread Carter Kozak
I’d rather use a name like ‘main’ or ‘develop’ for inclusivity (across all our projects). -ck > On Dec 23, 2021, at 08:41, Gary Gregory wrote: > > If we use this repo, is everyone OK renaming "trunk" to "master" in order > to match the branch name of our other repos? > > Gary > >> On Thu,

Re: New Log4j 1 repo

2021-12-23 Thread Gary Gregory
If we use this repo, is everyone OK renaming "trunk" to "master" in order to match the branch name of our other repos? Gary On Thu, Dec 23, 2021 at 1:34 AM Ralph Goers wrote: > I have cloned the read-only log4j repo to > https://github.com/apache/logging-log4j1. > > I have followed the build

Re: New Log4j 1 repo

2021-12-23 Thread Leo Simons
Hey, I am interested in legacy/vintage core enterprise systems deep inside large enterprises and governments, where source code changes are out of the question, that have lit up yellow in security/compliance dashboards due to the old CVE against log4j 1.2 for years, that now light up as orange

Re: New Log4j 1 repo

2021-12-23 Thread Christian Grobmeier
Hi, On Thu, Dec 23, 2021, at 13:33, Vladimir Sitnikov wrote: >>using maven toolchain feature > > Are toolchains really needed, especially, 1.6 and 1.7? > I believe Java "target=1.4" + Java 1.8 would be good enough. > If there are javadoc "warnings or errors", we could just suppress it. > At the

Re: New Log4j 1 repo

2021-12-23 Thread Gary Gregory
Vladimir, I appreciate your energy and your enthusiasm, I do, but you're going to have to pick your battles IMO. I would say we (not but really wearing my PMC hat) have passively agreed that we can move toward fixing CVEs and potential CVEs in what would be a 1.2.18. For us to get there and

Re: New Log4j 1 repo

2021-12-23 Thread Vladimir Sitnikov
>using maven toolchain feature Are toolchains really needed, especially, 1.6 and 1.7? I believe Java "target=1.4" + Java 1.8 would be good enough. If there are javadoc "warnings or errors", we could just suppress it. At the end of the day, making the build 100 times harder by requesting Java 1.6

Re: New Log4j 1 repo

2021-12-23 Thread Leo Simons
Hmm my best guess still is the javadoc warning>error. I didn’t think that started with JDK 8… The PR I had made for trunk has this fix for it https://github.com/apache/log4j/pull/16/commits/490255fbe6a3bc729c09be8ff36b6c965029d67c For the 1.2.17 PR that commit is not there, probably the broken

Re: New Log4j 1 repo

2021-12-23 Thread Vladimir Sitnikov
>All logging services Git repos start with logging-. I'm 100% sure INFRA can rename `apache/log4j` into `apache/logging-log4j1`, and it would be transparent for GitHub users. GitHub would automatically redirect from apache/log4j to apache/logging-log4j1 >Of course you are free to screw around

Re: New Log4j 1 repo

2021-12-23 Thread Apache
Thanks Leo. I was using Java 8 with maven 3 in a Linux VM. I don’t think maven 3 runs on Java 6. Ralph > On Dec 23, 2021, at 5:11 AM, Leo Simons wrote: > > On Thu, 23 Dec 2021 at 12:39, Ralph Goers > wrote: > >> It is still the middle of the night for me so I won’t do anything for >>

Re: New Log4j 1 repo

2021-12-23 Thread Apache
From what I can tell that repo could only be “owned” by a TLP named log4j.apache.org. It doesn’t show up on the list of gitbox repos owned by any ASF projects. I believe it is a read-only mirror tied to the sun repo. I asked infra about it in slack and they weren’t quite sure what it is. So

Re: New Log4j 1 repo

2021-12-23 Thread Leo Simons
On Thu, 23 Dec 2021 at 12:39, Ralph Goers wrote: > It is still the middle of the night for me so I won’t do anything for > several hours. Whoa, best get some rest! :) I will create the branch but I am curious about the rest. When I ran the > build last night it ran through a bunch of unit

Re: New Log4j 1 repo

2021-12-23 Thread Gary Gregory
Well done Ralph, I'll take a look today. Gary On Thu, Dec 23, 2021, 01:34 Ralph Goers wrote: > I have cloned the read-only log4j repo to > https://github.com/apache/logging-log4j1. > > I have followed the build instructions and had to modify the javadoc > plugin to not fail on errors. Now it

Re: New Log4j 1 repo

2021-12-23 Thread Vladimir Sitnikov
Leo>Instead of or in addition to some of those fixes I would suggest the following (in case you wonder, I might volunteer to do ALL of that, so don't assume I just sit and tell others how things should be done): 1. Use the existing repo https://github.com/apache/log4j instead of a newly created

Re: New Log4j 1 repo

2021-12-23 Thread Ralph Goers
Leo, It is still the middle of the night for me so I won’t do anything for several hours. I will create the branch but I am curious about the rest. When I ran the build last night it ran through a bunch of unit tests without any problems. It then failed due to javadoc errors. I just told the

Re: New Log4j 1 repo

2021-12-23 Thread Leo Simons
(On mobile) Cool. First I suggest to make a new branch from 1.2.17. Trunk has various stuff that’s backwards incompatible. Something like git checkout -b main v1_0_2_17 git push -u main Then go into GitHub settings and make main the default branch. So then people make PRs against that. Think

Re: New Log4j 1 repo

2021-12-22 Thread Vladimir Sitnikov
Ralph, thank you. Why did you create a new repository? AFAIK, infra could reopen the old one on request. Vladimir

Re: New Log4j 1 repo

2021-12-22 Thread Apache
https://github.com/apache/log4j was read-only. The new repo is not. Ralph > On Dec 22, 2021, at 11:34 PM, Ralph Goers wrote: > > I have cloned the read-only log4j repo to > https://github.com/apache/logging-log4j1. > > I have followed the build instructions and had to modify the javadoc

Re: New Log4j 1 repo

2021-12-22 Thread Xeno Amess
Do read only mean we cannot give pull request? Then how can I help you clean the pom correct... XenoAmess From: Ralph Goers Sent: Thursday, December 23, 2021 2:34:02 PM To: dev@logging.apache.org Subject: New Log4j 1 repo I have cloned the read-only log4j repo

New Log4j 1 repo

2021-12-22 Thread Ralph Goers
I have cloned the read-only log4j repo to https://github.com/apache/logging-log4j1. I have followed the build instructions and had to modify the javadoc plugin to not fail on errors. Now it fails in the site plugin. If someone else wants to take this on I would suggest the first PR should just