Skip to content
This repository was archived by the owner on Sep 13, 2023. It is now read-only.

Commit ef5a79d

Browse files
lsimonslsimons
committed
Start cleaning up ancient log4j 1.x to make a security release.
* README.md: describe intent and situation * LICENSE: update copyright year * .gitignore: start a git ignore file * INSTALL: note use of maven 3 / JDK 6 / toolchains.xml * pom.xml: update some old metadata, use toolchain
1 parent 7be00ee commit ef5a79d

File tree

5 files changed

+83
-43
lines changed

5 files changed

+83
-43
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
target/
2+
tests/output/

‎INSTALL‎

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -73,22 +73,30 @@ except test cases and classes from the "examples" and
7373
Building log4j
7474
==============
7575

76-
log4j (as of 1.2.15) is built with Maven 2. To rebuild log4j,
77-
place Maven 2 on the PATH and execute "mvn package". The resulting
78-
jar will be placed in the target subdirectory.
79-
80-
If building with JDK 1.4, one dependency will need to be manually
81-
installed since its license does not allow it to be placed in the
82-
online maven repositories. If not already installed, a build attempt will
83-
describe where to download and how to install the dependency. To
84-
install the dependency:
85-
86-
Download JMX 1.2.1 from http://java.sun.com/products/JavaManagement/download.html.
87-
88-
$ jar xf jmx-1_2_1-ri.zip
89-
$ mvn install:install-file -DgroupId=com.sun.jmx -DartifactId=jmxri \
90-
-Dversion=1.2.1 -Dpackaging=jar -Dfile=jmx-1_2_1-bin/lib/jmxri.jar
91-
76+
log4j (as of 1.2.18) is built with Maven 3 and JDK 6.
77+
78+
To configure your Maven installation to build with JDK 6, provide a
79+
~/.m2/toolchains.xml file defining an oracle jdk 1.6, for example:
80+
81+
<?xml version="1.0" encoding="UTF-8"?>
82+
<toolchains>
83+
<toolchain>
84+
<type>jdk</type>
85+
<provides>
86+
<version>1.6</version>
87+
<vendor>oracle</vendor>
88+
</provides>
89+
<configuration>
90+
<jdkHome>/usr/lib/jvm/java-1.6.0-openjdk-amd64</jdkHome>
91+
<!-- <jdkHome>C:\Program Files\Java\jdk1.6.0_45</jdkHome> -->
92+
</configuration>
93+
</toolchain>
94+
</toolchains>
95+
96+
Either Oracle JDK 6 or OpenJDK 6 is supported, but our pom expects vendor "oracle".
97+
98+
To rebuild log4j, place Maven 3 on the PATH and execute "mvn package".
99+
The resulting jar will be placed in the target subdirectory.
92100

93101
The build script will attempt to build NTEventLogAppender.dll if
94102
MinGW is available on the path. If the unit tests are run on Windows

‎NOTICE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
Apache log4j
2-
Copyright 2010 The Apache Software Foundation
2+
Copyright 2010-2021 The Apache Software Foundation
33

44
This product includes software developed at
55
The Apache Software Foundation (http://www.apache.org/).

‎README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Work In Progress
2+
3+
Not ready for use.
4+
5+
# End Of Life
6+
7+
On August 5, 2015 the Logging Services Project Management Committee announced that Log4j 1.x had reached end of life. For complete text of the announcement please see the [Apache Blog](https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces). Users of Log4j 1 are recommended to upgrade to [Apache Log4j 2](https://logging.apache.org/log4j/2.x/index.html).
8+
9+
# Security release 1.2.18
10+
11+
On December 10, 2021 the Logging Services Project Management Committee announced the release of Log4j 2.15 to fix a critical security vulnerability, followed by Log4j 2.16 on December 13 with further fixes for this vulnerability, with details on the [Log4j Security Page](https://logging.apache.org/log4j/2.x/security.html). All log4j users should follow this security advice.
12+
13+
For remaining users of log4j 1.2 and older, the recommended upgrade path remains to migrate to [Apache Log4j 2](https://logging.apache.org/log4j/2.x/index.html). Log4j 1.2 does not suffer from the same security vulnerabilities in the same way, but users should still upgrade: Log4j 1.2 does have an older known vulnerability [CVE-2019-17571](https://www.cvedetails.com/cve/CVE-2019-17571/) and per the above end-of-life notice is UNMAINTAINED software since 2015. It is possible Log4j 1.2 has several unknown vulnerabilities.
14+
15+
For users that cannot upgrade to Log4j 2.x, a somewhat-secured version of Log4j 1.2 is being made as Log4j 1.2.18. This is a new release of otherwise UNMAINTAINED software. While 1.2.18 will fix a critical security vulnerability and has some improvements to the library that should help with security, it remains End Of Life and users should make plans to upgrade to 2.x.
16+
17+
## Changes in 1.2.18
18+
19+
* ...

‎pom.xml‎

Lines changed: 37 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -34,39 +34,28 @@ target platform and specify -Dntdll_target=msbuild on the mvn command line.
3434
<packaging>bundle</packaging>
3535
<name>Apache Log4j</name>
3636
<version>1.2.18-SNAPSHOT</version>
37-
<description>Apache Log4j 1.2</description>
37+
<description>Apache Log4j 1.2 (UNMAINTAINED)</description>
3838
<url>http://logging.apache.org/log4j/1.2/</url>
3939
<issueManagement>
40-
<system>Bugzilla</system>
41-
<url>https://issues.apache.org/bugzilla/describecomponents.cgi?product=Log4j</url>
40+
<!-- not really, this is for 2.x, but Bugzilla for Log4j is also disabled -->
41+
<system>Jira</system>
42+
<url>https://issues.apache.org/jira/projects/LOG4J2</url>
4243
</issueManagement>
43-
<ciManagement>
44-
<system>Gump</system>
45-
<url>http://vmgump.apache.org/gump/public/logging-log4j-12/logging-log4j-12/index.html</url>
46-
</ciManagement>
4744
<inceptionYear>1999</inceptionYear>
4845
<mailingLists>
4946
<mailingList>
5047
<name>log4j-user</name>
5148
<subscribe>log4j-user-subscribe@logging.apache.org</subscribe>
5249
<unsubscribe>log4j-user-unsubscribe@logging.apache.org</unsubscribe>
5350
<post>log4j-user@logging.apache.org</post>
54-
<archive>http://mail-archives.apache.org/mod_mbox/logging-log4j-user/</archive>
55-
<otherArchives>
56-
<otherArchive>http://marc.info/?l=log4j-user</otherArchive>
57-
<otherArchive>http://dir.gmane.org/gmane.comp.jakarta.log4j.user</otherArchive>
58-
</otherArchives>
51+
<archive>https://lists.apache.org/list.html?log4j-user@logging.apache.org</archive>
5952
</mailingList>
6053
<mailingList>
6154
<name>log4j-dev</name>
62-
<subscribe>log4j-dev-subscribe@logging.apache.org</subscribe>
63-
<unsubscribe>log4j-dev-unsubscribe@logging.apache.org</unsubscribe>
64-
<post>log4j-dev@logging.apache.org</post>
65-
<archive>http://mail-archives.apache.org/mod_mbox/logging-log4j-dev/</archive>
66-
<otherArchives>
67-
<otherArchive>http://marc.info/?l=log4j-dev</otherArchive>
68-
<otherArchive>http://dir.gmane.org/gmane.comp.jakarta.log4j.devel</otherArchive>
69-
</otherArchives>
55+
<subscribe>dev-subscribe@logging.apache.org</subscribe>
56+
<unsubscribe>dev-unsubscribe@logging.apache.org</unsubscribe>
57+
<post>dev@logging.apache.org</post>
58+
<archive>https://lists.apache.org/list.html?dev@logging.apache.org</archive>
7059
</mailingList>
7160
</mailingLists>
7261
<licenses>
@@ -77,16 +66,36 @@ target platform and specify -Dntdll_target=msbuild on the mvn command line.
7766
</license>
7867
</licenses>
7968
<scm>
80-
<connection>scm:svn:http://svn.apache.org/repos/asf/logging/log4j/trunk</connection>
81-
<developerConnection>scm:svn:https://svn.apache.org/repos/asf/logging/log4j/trunk</developerConnection>
82-
<url>http://svn.apache.org/viewvc/logging/log4j/trunk</url>
69+
<connection>scm:git:https://github.com/apache/log4j</connection>
70+
<developerConnection>scm:svn:https://gitbox.apache.org/repos/asf/logging-log4j1.git</developerConnection><!-- todo -->
71+
<url>https://gitbox.apache.org/repos/asf/logging-log4j2.git</url>
8372
</scm>
8473
<organization>
8574
<name>Apache Software Foundation</name>
8675
<url>http://www.apache.org</url>
8776
</organization>
8877
<build>
8978
<plugins>
79+
<plugin>
80+
<groupId>org.apache.maven.plugins</groupId>
81+
<artifactId>maven-toolchains-plugin</artifactId>
82+
<version>1.1</version>
83+
<executions>
84+
<execution>
85+
<goals>
86+
<goal>toolchain</goal>
87+
</goals>
88+
</execution>
89+
</executions>
90+
<configuration>
91+
<toolchains>
92+
<jdk>
93+
<version>1.6</version>
94+
<vendor>oracle</vendor>
95+
</jdk>
96+
</toolchains>
97+
</configuration>
98+
</plugin>
9099
<plugin>
91100
<groupId>org.apache.maven.plugins</groupId>
92101
<artifactId>maven-resources-plugin</artifactId>
@@ -344,13 +353,16 @@ target platform and specify -Dntdll_target=msbuild on the mvn command line.
344353
<version>3.8.1</version>
345354
<scope>compile</scope>
346355
</dependency>
347-
<dependency>
356+
<!--
357+
does not seem to be needed if not rebuilding .dll
358+
359+
<dependency>
348360
<groupId>sun.jdk</groupId>
349361
<artifactId>tools</artifactId>
350362
<version>1.4.2</version>
351363
<scope>system</scope>
352364
<systemPath>${tools.jar}</systemPath>
353-
</dependency>
365+
</dependency>-->
354366
</dependencies>
355367
</plugin>
356368
<plugin>
@@ -593,4 +605,3 @@ target platform and specify -Dntdll_target=msbuild on the mvn command line.
593605
</site>
594606
</distributionManagement>
595607
</project>
596-

0 commit comments

Comments
 (0)