From f8ff8a7b8a09d6db52b74e5db2be9bcb3fad9eb9 Mon Sep 17 00:00:00 2001
From: Geoff Bourne <itzgeoff@gmail.com>
Date: Thu, 8 Jan 2026 07:25:01 -0600
Subject: [PATCH] Opt into generated log4j2.xml configuration (#3856)

---
 .github/workflows/build.yml        |  1 +
 .github/workflows/verify-pr.yml    |  1 +
 docs/configuration/misc-options.md |  2 ++
 scripts/start-finalExec            | 10 ++++++----
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9b09dd47..b21a0d91 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -175,6 +175,7 @@ jobs:
           MINECRAFT_VERSION: ${{ matrix.mcVersion }}
           VARIANT: ${{ matrix.variant }}
           CF_API_KEY: ${{ secrets.CF_API_KEY }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           tests/test.sh
 
diff --git a/.github/workflows/verify-pr.yml b/.github/workflows/verify-pr.yml
index 69337fa8..420b8825 100644
--- a/.github/workflows/verify-pr.yml
+++ b/.github/workflows/verify-pr.yml
@@ -92,5 +92,6 @@ jobs:
           VARIANT: ${{ matrix.variant }}
           CF_API_KEY: ${{ secrets.CF_API_KEY }}
           DEBUG: ${{ runner.debug }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           tests/test.sh
diff --git a/docs/configuration/misc-options.md b/docs/configuration/misc-options.md
index 717e8ca1..39b4952a 100644
--- a/docs/configuration/misc-options.md
+++ b/docs/configuration/misc-options.md
@@ -81,6 +81,8 @@ The openj9 image tags include specific variables to simplify configuration:
 
 The image now uses a templated log4j2 configuration based on PaperMC's logging setup, which is automatically applied for versions that don't require Log4j security patches. This configuration provides rolling logs and advanced logging features by default.
 
+Set the environment variable `GENERATE_LOG4J2_CONFIG` to "true" to enable the following features.
+
 ### Customization via environment variables
 
 You can customize various aspects of the logging behavior using environment variables:
diff --git a/scripts/start-finalExec b/scripts/start-finalExec
index 90e23155..eb8e1fcb 100755
--- a/scripts/start-finalExec
+++ b/scripts/start-finalExec
@@ -47,7 +47,7 @@ if [ -n "$ICON" ]; then
     fi
 fi
 
-canUseRollingLogs=true
+useGeneratedLogs=${GENERATE_LOG4J2_CONFIG:-false}
 useFallbackJvmFlag=false
 
 SERVER_DIR="$baseDataDir"
@@ -65,7 +65,7 @@ patchLog4jConfig() {
     return 1
   fi
   JVM_OPTS="-Dlog4j.configurationFile=${file} ${JVM_OPTS}"
-  canUseRollingLogs=false
+  useGeneratedLogs=false
 }
 
 # Temporarily disable debugging output
@@ -104,7 +104,8 @@ elif versionLessThan 1.18.1; then
 fi
 
 # Set up log4j2 configuration with templating support
-if ${canUseRollingLogs}; then
+LOGFILE="${SERVER_DIR}/log4j2.xml"
+if ${useGeneratedLogs}; then
   # Set up log configuration defaults
   : "${LOG_LEVEL:=info}"
   : "${ROLLING_LOG_MAX_FILES:=1000}"
@@ -128,7 +129,6 @@ if ${canUseRollingLogs}; then
   export LOG_LEVEL ROLLING_LOG_FILE_PATTERN ROLLING_LOG_MAX_FILES
   export LOG_CONSOLE_FORMAT LOG_TERMINAL_FORMAT LOG_FILE_FORMAT
 
-  LOGFILE="${SERVER_DIR}/log4j2.xml"
 
   # Always regenerate if file doesn't exist
   if [ ! -e "$LOGFILE" ] || isTrue "${REGENERATE_LOG4J2:-true}"; then
@@ -176,6 +176,8 @@ elif isTrue "${ENABLE_ROLLING_LOGS:-false}"; then
   # Legacy behavior: error if rolling logs explicitly requested but not possible
   logError "Using rolling logs is currently not possible in the selected version due to CVE-2021-44228"
   exit 1
+else
+  rm -f "${LOGFILE}"
 fi
 
 # Optional disable console