Re: [VOTE] Release Log4j 2.25.4
Gary Gregory <[email protected]> Wed, 25 Mar 2026 07:50:32 -0400
| Newsgroups | gmane.comp.jakarta.log4j.devel |
|---|---|
| Message-ID | <CACZkXPy7VE_jMyDPbVQrVkrQWeY5FfL2wiy+u7AqPYPWfLPoNg__1977.51973043836$1774439505$gmane$org@mail.gmail.com> |
On Wed, Mar 25, 2026, 05:50 Piotr P. Karwasz <[email protected]> wrote: > Hi all, > > On 25.03.2026 10:32, [email protected] wrote: > > The ATR release candidate page, including downloads, can be found at: > > > > https://release-test.apache.org/vote/logging-log4j/2.25.4 > > > You'll find a lot of failed checks on this page. The main reason for > that, is that the content of our source and binary archive is not > wrapped in a directory. > Hi Piotr, Thank you for preparing the RC. Does that mean all the RAT check failures about missing license headers are incorrect? Gary > We'll fix that in future releases, since I plan to: > > - Use `git archive` to generate the source archive. > - Drop the binary archive completely: less than 1 user in 10,000 > downloads JARs from our website. > - We'll consider a SLSA Provenance attestation to prove the authenticity > of the artifacts in Central instead. > > Piotr >