brooklyn-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From rich...@apache.org
Subject [1/5] incubator-brooklyn git commit: Website download/verify page update for 0.7.0-M2
Date Tue, 23 Dec 2014 13:20:15 GMT
Repository: incubator-brooklyn
Updated Branches:
  refs/heads/master c88796ad1 -> f6f389840


Website download/verify page update for 0.7.0-M2

Rewrites the website download page, and moves the verify page from the
guide to the website.


Project: http://git-wip-us.apache.org/repos/asf/incubator-brooklyn/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-brooklyn/commit/7bcbfbe4
Tree: http://git-wip-us.apache.org/repos/asf/incubator-brooklyn/tree/7bcbfbe4
Diff: http://git-wip-us.apache.org/repos/asf/incubator-brooklyn/diff/7bcbfbe4

Branch: refs/heads/master
Commit: 7bcbfbe482d3d64ab5e5ac0f4308871f373929f1
Parents: d57521c
Author: Richard Downer <richard@apache.org>
Authored: Tue Dec 23 11:07:23 2014 +0000
Committer: Richard Downer <richard@apache.org>
Committed: Tue Dec 23 11:48:59 2014 +0000

----------------------------------------------------------------------
 docs/guide/meta/verify.md       | 36 ---------------
 docs/website/download.md        | 72 +++++++++---------------------
 docs/website/download/verify.md | 85 ++++++++++++++++++++++++++++++++++++
 3 files changed, 106 insertions(+), 87 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-brooklyn/blob/7bcbfbe4/docs/guide/meta/verify.md
----------------------------------------------------------------------
diff --git a/docs/guide/meta/verify.md b/docs/guide/meta/verify.md
deleted file mode 100644
index 74037fa..0000000
--- a/docs/guide/meta/verify.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-layout: guide-normal
-title: Verify the Integrity of Downloads
-toc: /guide/toc.json
----
-{% include fields.md %}
-
-It is essential for security that you verify the integrity of the downloaded files using
their PGP signatures or SHA-1 checksums.
-
-### Verifying PGP signatures using PGP or GPG
-
-Download the [brooklyn-gpg-public-key.asc](brooklyn-gpg-public-key.asc)
-file and the `.asc` PGP signature file for the relevant artefact.
-
-(Make sure you get these files from the main {% if SNAPSHOT %}[Maven Central]({{ mavencentral_repo_groupid_url
}}){% else %}[Sonatype]({{ sonatype_repo_groupid_url }}){% endif %} repository rather than
from a mirror.)
-
-Verify the signatures using one of the following commands:
-
-	pgpk -a brooklyn-gpg-public-key.asc
-	pgpv brooklyn-{{ site.brooklyn-version }}-dist.tar.gz.asc
-
-or
-
-	pgp -ka brooklyn-gpg-public-key.asc
-	pgp brooklyn-{{ site.brooklyn-version }}-dist.zip.asc
-
-or
-
-	gpg --import brooklyn-gpg-public-key.asc	
-	gpg --verify brooklyn-{{ site.brooklyn-version }}-dist.tar.gz.asc
-
-You can also verify the SHA-1 checksum of the files.
-
-A program called `sha1` or `sha1sum` is included in most Linux distributions and OSx. For
Windows users, `fsum` supports SHA-1. 
-
-Ensure the generated checksum string matches the contents of the `.sha1` file for the relevant
artefact (and again download from {% if SNAPSHOT %}[Maven Central]({{ mavencentral_repo_groupid_url
}}){% else %}[Sonatype]({{ sonatype_repo_groupid_url }}){% endif %} repository, rather than
from a mirror).

http://git-wip-us.apache.org/repos/asf/incubator-brooklyn/blob/7bcbfbe4/docs/website/download.md
----------------------------------------------------------------------
diff --git a/docs/website/download.md b/docs/website/download.md
index 20d6410..21ae6a6 100644
--- a/docs/website/download.md
+++ b/docs/website/download.md
@@ -1,70 +1,40 @@
 ---
 layout: website-normal
 title: Download
+children:
+- { path: download/verify.md }
 ---
 
-## Download Brooklyn Binary Distributions
+## Get the Brooklyn Source Code
 
-**New to Brooklyn**? Download the *Milestone* release below then take a look
-at the [Get Started](quickstart/) page.
+[Download Apache Brooklyn 0.7.0-M2-incubating from our mirror sites](https://www.apache.org/dyn/closer.cgi/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz)
 
-<div class="row">
-<div class="col-md-6" markdown="1">
+You can also verify that you build has not been tampered with by [verifying the hashes and
signatures](download/verify.md).
 
-### Milestone
 
-#### 0.7.0-M1
-*Recommended*. A good compromise between stability and features which has undergone live
testing.
+## Build the Binary Package
 
-Download [.tar.gz](http://search.maven.org/remotecontent?filepath=io/brooklyn/brooklyn-dist/0.7.0-M1/brooklyn-dist-0.7.0-M1-dist.tar.gz)
-&bull; [.zip](http://search.maven.org/remotecontent?filepath=io/brooklyn/brooklyn-dist/0.7.0-M1/brooklyn-dist-0.7.0-M1-dist.zip)
+We do not yet have an official binary package for Apache Brooklyn. We plan to address this
in our next release. However,
+it is relatively easy to create the binary package from source code, if you have a working
JDK of at least version 6,
+and Maven 3.
 
-Please note that this release was made prior to entering the Apache Incubator, and therefore
it is not endorsed by Apache.
+Unpack `apache-brooklyn-0.7.0-M2-incubating.tar.gz` and then execute this command in the
`apache-brooklyn-0.7.0-M2-incubating` folder:
 
-</div>
-<div class="col-md-6" markdown="1">
+{% highlight bash %}
+mvn clean install -DskipTests
+{% endhighlight %}
 
-### Stable
+You can then find the binary distribution in the folder `usage/dist/target/brooklyn-dist`,
or archived as `usage/dist/target/brooklyn-0.7.0-M2-incubator-dist.tar.gz`.
 
-#### 0.6.0
-Well-tested releases, but missing the latest features.
 
-Download [.tar.gz](http://search.maven.org/remotecontent?filepath=io/brooklyn/brooklyn-dist/0.6.0/brooklyn-dist-0.6.0-dist.tar.gz)
-&bull; [.zip](http://search.maven.org/remotecontent?filepath=io/brooklyn/brooklyn-dist/0.6.0/brooklyn-dist-0.6.0-dist.zip)
+## Get Started!
 
-Please note that this release was made prior to entering the Apache Incubator, and therefore
it is not endorsed by Apache.
+Take a look at the [Get Started](quickstart/) page!
 
-</div>
-</div>
 
+## Previous Versions
 
-## Download Brooklyn source code
-
-<div class="row">
-<div class="col-md-6" markdown="1">
-
-### Milestone
-
-#### 0.7.0-M1
-*Recommended*. A good compromise between stability and features which has undergone live
testing.
-
-Download [.tar.gz](https://github.com/apache/incubator-brooklyn/archive/0.7.0-M1.tar.gz)
-&bull; [.zip](https://github.com/apache/incubator-brooklyn/archive/0.7.0-M1.zip)
-
-Please note that this release was made prior to entering the Apache Incubator, and therefore
it is not endorsed by Apache.
-
-</div>
-<div class="col-md-6" markdown="1">
-
-### Stable
-
-#### 0.6.0
-Well-tested releases, but missing the latest features.
-
-Download [.tar.gz](https://github.com/apache/incubator-brooklyn/archive/v0.6.0.tar.gz)
-&bull; [.zip](https://github.com/apache/incubator-brooklyn/archive/v0.6.0.zip)
-
-Please note that this release was made prior to entering the Apache Incubator, and therefore
it is not endorsed by Apache.
-
-</div>
-</div>
+Versions of Brooklyn prior to 0.7.0-M2 were all made prior to joining the Apache Incubator,
therefore **they are not
+endorsed by Apache** and are not hosted by Apache or their mirrors. You can obtain the source
code by [inspecting the
+branches of the pre-Apache GitHub repository](https://github.com/brooklyncentral/brooklyn/branches/stale)
and binary
+releases by [querying Maven Central for io.brooklyn:brooklyn.dist](http://search.maven.org/#search%7Cgav%7C1%7Cg%3A%22io.brooklyn%22%20AND%20a%3A%22brooklyn-dist%22).

http://git-wip-us.apache.org/repos/asf/incubator-brooklyn/blob/7bcbfbe4/docs/website/download/verify.md
----------------------------------------------------------------------
diff --git a/docs/website/download/verify.md b/docs/website/download/verify.md
new file mode 100644
index 0000000..d4e6abe
--- /dev/null
+++ b/docs/website/download/verify.md
@@ -0,0 +1,85 @@
+---
+layout: website-normal
+title: Verify the Integrity of Downloads
+---
+
+It is essential for security that you verify the integrity of the downloaded files using
their PGP signatures or SHA-1 checksums.
+
+
+## Verifying hashes
+
+You can download MD5, SHA1 and SHA256 hashes using these links. Note that these links are
for first-class Apache
+Software Foundation mirrors so there will be reduced opportunity for tampering with these
files.
+
+<table class="table">
+<tr>
+<th>Artifact</th>
+<th colspan="2">MD5 hash</th>
+<th colspan="2">SHA1 hash</th>
+<th colspan="2">SHA256 hash</th>
+</tr>
+<tr>
+<td>apache-brooklyn-0.7.0-M2-incubating.tar.gz</td>
+<td><a href="https://www.us.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.md5">US</a></td>
+<td><a href="https://www.eu.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.md5">EU</a></td>
+<td><a href="https://www.us.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.sha1">US</a></td>
+<td><a href="https://www.eu.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.sha1">EU</a></td>
+<td><a href="https://www.us.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.sha256">US</a></td>
+<td><a href="https://www.eu.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.sha256">EU</a></td>
+</tr>
+</table>
+
+You can verify the SHA1 or SHA256 hashes easily by placing the files in the same folder as
the download artifact and
+then running `shasum`, which is included in most UNIX-like systems:
+
+{% highlight bash %}
+shasum -c apache-brooklyn-0.7.0-M2-incubating.tar.gz.sha1
+shasum -c apache-brooklyn-0.7.0-M2-incubating.tar.gz.sha256
+{% endhighlight %}
+
+You can verify the MD5 hashes by running a command like this, and comparing the output to
the contents of the `.md5` file:
+
+{% highlight bash %}
+md5 apache-brooklyn-0.7.0-M2-incubating.tar.gz
+{% endhighlight %}
+
+
+### Verifying PGP signatures using PGP or GPG
+
+You can download PGP/GPG signatures using these links. Note that these links are for first-class
Apache
+Software Foundation mirrors so there will be reduced opportunity for tampering with these
files.
+
+<table class="table">
+<tr>
+<th>Artifact</th>
+<th colspan="2">Mirror</th>
+</tr>
+<tr>
+<td>Release Manager's public keys (KEYS)</td>
+<td><a href="https://www.us.apache.org/dist/incubator/brooklyn/KEYS">US</a></td>
+<td><a href="https://www.eu.apache.org/dist/incubator/brooklyn/KEYS">EU</a></td>
+</tr>
+<tr>
+<td>apache-brooklyn-0.7.0-M2-incubating.tar.gz.asc</td>
+<td><a href="https://www.us.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.asc">US</a></td>
+<td><a href="https://www.eu.apache.org/dist/incubator/brooklyn/0.7.0-M2-incubating/apache-brooklyn-0.7.0-M2-incubating.tar.gz.asc">EU</a></td>
+</tr>
+</table>
+
+In order to validate the release signature, download both the release `.asc` file for the
release, and the `KEYS` file
+which contains the public keys of key individuals in the Apache Brooklyn project.
+
+Verify the signatures using one of the following commands:
+
+	pgpk -a KEYS
+	pgpv brooklyn-{{ site.brooklyn-version }}-dist.tar.gz.asc
+
+or
+
+	pgp -ka KEYS
+	pgp brooklyn-{{ site.brooklyn-version }}-dist.zip.asc
+
+or
+
+	gpg --import KEYS
+	gpg --verify brooklyn-{{ site.brooklyn-version }}-dist.tar.gz.asc


Mime
View raw message