I work for a software house and we've used log4j 1.2 in a lot of our older code. Following the recent Logshell incident (which I know doesn't concern log4j 1.2 directly), we've considered migrating to the latest secure release of log4j i.e. 2.17.0 and later. However, we would like to be able to do that without having to change our existing code base.
I came across the log4j-1.2 API bridge which allows us to use log4j2 in the background through the same API as log4j 1.2. However, our custom code uses PropertyConfigurator to configure the logger through log4j 1.2 format properties files, and the API Bridge does not offer an implementation for it. Therefore, our company wants to develop an implementation for the PropertyConfigurator class ourselves. I realize that there is experimental support offered for log4j 1.2 configuration files in log4j 2.13.0 onwards, but we would prefer to have our own implementation.
Log4j API Bridge: https://logging.apache.org/log4j/2.x/log4j-1.2-api/index.html
My understanding is that since log4j (including the API bridge) is under the Apache 2.0 license, it is legal to modify the code and even sell it as a proprietary product as long as I retain the original copyright, license, notice files in the code/artifact and also include a statement of significant changes. However, I also understand that we are not allowed to use trademarks such as the "log4j" name in the product.
Apache 2.0 License explained https://fossa.com/blog/open-source-licenses-101-apache-license-2-0/
I wanted to confirm if it is okay to develop and sell this product under a new name (product name, group name, artifact name), while still retaining the API and package name (org.apache.log4j) from log4j 1.x API. Retaining the package name is essential in order to avoid changing our code base which depends on log4j 1.2. Furthermore, how can I know exactly what is part of the trademarks for log4j? Also are there other conditions that we would be required to meet. Thanks
