2

I work for a software house and we've used log4j 1.2 in a lot of our older code. Following the recent Logshell incident (which I know doesn't concern log4j 1.2 directly), we've considered migrating to the latest secure release of log4j i.e. 2.17.0 and later. However, we would like to be able to do that without having to change our existing code base.

I came across the log4j-1.2 API bridge which allows us to use log4j2 in the background through the same API as log4j 1.2. However, our custom code uses PropertyConfigurator to configure the logger through log4j 1.2 format properties files, and the API Bridge does not offer an implementation for it. Therefore, our company wants to develop an implementation for the PropertyConfigurator class ourselves. I realize that there is experimental support offered for log4j 1.2 configuration files in log4j 2.13.0 onwards, but we would prefer to have our own implementation.

Log4j API Bridge: https://logging.apache.org/log4j/2.x/log4j-1.2-api/index.html

My understanding is that since log4j (including the API bridge) is under the Apache 2.0 license, it is legal to modify the code and even sell it as a proprietary product as long as I retain the original copyright, license, notice files in the code/artifact and also include a statement of significant changes. However, I also understand that we are not allowed to use trademarks such as the "log4j" name in the product.

Apache 2.0 License explained https://fossa.com/blog/open-source-licenses-101-apache-license-2-0/

I wanted to confirm if it is okay to develop and sell this product under a new name (product name, group name, artifact name), while still retaining the API and package name (org.apache.log4j) from log4j 1.x API. Retaining the package name is essential in order to avoid changing our code base which depends on log4j 1.2. Furthermore, how can I know exactly what is part of the trademarks for log4j? Also are there other conditions that we would be required to meet. Thanks

1
  • The license obviously grants the right to use and modify the code, even for commercial purposes. Apache has trademarks so if you plan to use that for something proprietary you will want to contact them first. Also the org.apache tree and package names indicate that it is an Apache Software Foundation project, so naming your own in the same way (if that is possible) will cause confusion Jan 22, 2022 at 14:39

1 Answer 1

1

The license obviously grants the right to use and modify the code, even for commercial purposes. Apache has trademarks, including "Apache Log4j 2" so if you plan to use that for something proprietary you will want to contact the Apache Software Foundation first.

Also the org.apache tree and package names indicate that it is an Apache Software Foundation project, so naming your own in the same way (I doubt if that is even possible) will cause confusion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.