Shibboleth Developers

["Scott Cantor" <>]

With the impending release of a public test version, and the early feedback
I'm seeing from testers, I think I need to make a decision about log4cpp.

As most here know, we've been distributing a patched version for a while
that was derived from a snapshot that dates back several years. I applied a
variety of changes, most of them from patches that were submitted to that
project's list, to make the library thread-safe (or at least much moreso
than it was) and to get the configure script working properly. The result
has been fairly stable, at least enough for most people to live with. I
still believe many of the crashes people experience can be traced to it, but
they seem much rarer now.

It's come to my attention that somebody got the idea to package up a broken
version for Debian, and so there's obviously a problem there. Note that
there is no official release of that code from the sourceforge project in
many years, there have only been broken snapshots.

Before somebody asks, there are really no simple alternatives for me. The
Apache log4cxx project has been languishing for years and I just can't trust
it, even if I had the time to port the code to it. The other good candidate
I have looks decent, but has some large dependencies, and the build is bad
enough as it is.

The only real drawbacks to log4cpp are the fact that it's been a dead
project with just enough signs of life to cause problems, and that it's
LGPL'd instead of more liberally licensed, but the latter just doesn't
bother me.

So, my quandary is whether I can afford the time right now to actually make
contact and attempt to get the real log4cpp fixed so that it actually works,
and I just don't like the odds. My preferred direction is to fork it. I can
do that as long as I keep all the original copyright intact, and any of the
changed code is LGPL'd by Internet2.

The main purpose of the fork is to stamp the thing 1.0 and rename it, so
that it won't interfere with the "real" log4cpp anymore. In doing this, I
will probably need to make some changes to allow for either my version or
some potential future version of log4cpp that actually works to be used.

I'd note that both versions of the SP (1.3 and 2.0) are going to be
modified, as they will be sharing the same library set going forward.

Are there any concerns about this?

-- Scott