Reply-To: rave-dev@incubator.apache.org Delivered-To: mailing list rave-commits@incubator.apache.org Received: (qmail 45692 invoked by uid 99); 14 Jun 2011 21:29:32 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 14 Jun 2011 21:29:32 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=5.0 tests=ALL_TRUSTED,WEIRD_PORT X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 14 Jun 2011 21:29:26 +0000 Received: by eris.apache.org (Postfix, from userid 65534) id CD4EA2388A64; Tue, 14 Jun 2011 21:29:04 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: svn commit: r790959 - in /websites/staging/rave/trunk/content/rave: release-management.html release-process.html release-setup.html Date: Tue, 14 Jun 2011 21:29:04 -0000 To: rave-commits@incubator.apache.org From: buildbot@apache.org X-Mailer: svnmailer-1.0.8 Message-Id: <20110614212904.CD4EA2388A64@eris.apache.org> X-Virus-Checked: Checked by ClamAV on apache.org Author: buildbot Date: Tue Jun 14 21:29:04 2011 New Revision: 790959 Log: Staging update by buildbot Added: websites/staging/rave/trunk/content/rave/release-management.html websites/staging/rave/trunk/content/rave/release-process.html websites/staging/rave/trunk/content/rave/release-setup.html Added: websites/staging/rave/trunk/content/rave/release-management.html ============================================================================== --- websites/staging/rave/trunk/content/rave/release-management.html (added) +++ websites/staging/rave/trunk/content/rave/release-management.html Tue Jun 14 21:29:04 2011 @@ -0,0 +1,88 @@ + + + + + + + Release Management + + + + + + + + +

Release Management

Release artifacts are distributed via the Apache Nexus repository for both SNAPSHOT and versioned releases. In addition to Nexus, a source and standalone binary release will be made available via the Apache Distribution Area.

To familiarize yourself with the notions and requirements for releasing artifacts, please checkout the Apache Release FAQ.

Since we are an Incubator project, also checkout the Incubator Release Guidelines.

Apache Rave Release Guidelines

+ + + + + Added: websites/staging/rave/trunk/content/rave/release-process.html ============================================================================== --- websites/staging/rave/trunk/content/rave/release-process.html (added) +++ websites/staging/rave/trunk/content/rave/release-process.html Tue Jun 14 21:29:04 2011 @@ -0,0 +1,336 @@ + + + + + + + + + + + + + + + +

Title:Release Process +Notice: Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + . + http://www.apache.org/licenses/LICENSE-2.0 + . + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License.

Incubator Release Steps

Environment setup for releasing artifacts (same for SNAPSHOTs and releases) -
+
Increase the default Java heap available to Maven (required for Java SE 6)
+
+
export MAVEN_OPTS="-Xmx1024m -XX:MaxPermSize=256m"
+
+
Use the latest Sun 1.6.0 JDK
+
Use Maven 3.0.3 or later
+
Make sure the Release Setup steps have been performed.
+
+
Prepare the source for release:
+
Cleanup JIRA so the Fix Version in issues resolved since the last release includes this release version correctly. Also, transition any Resolved issues to the Closed state.
Update the text files in a working copy of the project root -
1. Update the CHANGES.txt based on the Text release reports from JIRA.
2. Review and update README.txt if needed.
3. Commit any changes back to svn
+
+
Stage any Roadmap or Release landing pages on the site.
+
+
Checkout a clean copy of the trunk/branch to release using command line svn.
+
+

Do not use Eclipse to do the checkout. The extra dot (.) files created by Eclipse throws off the rat:check processing. +4. Use mvn verify to verify the source has the required headers before trying to release. +5. Do a dry run of the release:prepare step.
+

The dry run will not commit any changes back to SVN and gives you the opportunity to verify that the release process will complete as expected. You will be prompted for the following information : + * Release version - take the default + * SCM release tag - DO NOT TAKE THE DEFAULT -: : 0.1-incubating + * New development version - take the default + * GPG Passprhase

$ mvn -Papache-release release:prepare -DdryRun=true

*If you cancel a release:prepare before it updates the pom.xml versions, then use the release:clean goal to just remove the extra files that were created.*
+

+ + +

+
1. The release plugin will create pom.xml.tag files which contain the changes that would have been committed to SVN. The only differences between pom.xml.tag and it's corresponding pom.xml file should be the version number.
2. +
  If other formatting changes have been made you should review the changes and then commit them -
  +
  +
```
`$ svn commit -m "fixing formatting for release"`
+
```
  + + +
+
Verify that the release process completed as expected
+
1. Check release.properties and make sure that the scm properties have the right version. Sometimes the scm location can be the previous version not the next version.
2. verify signatures (Verifying release signatures)
+
+
Once any failures or required updates have been committed to svn, rollback the release prepare files -
+
+

$ mvn -Papache-release release:rollback

Prepare the release
+
Run the "release:prepare" step for real this time. You'll be prompted for the same version information.
+
Different arguments and steps are required as there are problems with the maven-jar-plugin and maven-release-plugin when using the test-jar goal. See http://jira.codehaus.org/browse/MJAR-68 and http://jira.codehaus.org/browse/MRELEASE-285.
+
$ mvn release:prepare -Papache-release -DskipTests=true -DpreparationGoals="clean install cargo:package"
+
+
Backup (zip or tar) your local release candidate directory in case you need to rollback the release after the next step is performed.
+
+
Perform the release
+

This step will create a maven staging repository and site for use in testing and voting.

$ mvn release:perform -Papache-release -Duser.name=<your_apache_uid>

*If your local OS userid doesn't match your Apache userid, then you'll have to also override the value provided by the OS to Maven for the site-deploy step to work. This is known to work for Linux, but not for Mac and unknown for Windows.*
+
+    *The maven-release-plugin is configured with goals "deploy site site:deploy" and will deploy the site files to a staging-site directory on people.apache.org.*
+

+ + +

Verify the release artifacts
Verify the HTML links in site are correct
Verify the staged artifacts in the nexus repo
+ 1. https://repository.apache.org/index.html + 2. Enterprise --> Staging + 3. Staging tab --> Name column --> org.apache.bval + 4. Navigate through the artifact tree and make sure that all javadoc, sources, tests, jars, ... have .asc (GPG signature) and .md5 files. See http://people.apache.org/~henkp/repo/faq.html and http://www.apache.org/dev/release-signing.html#openpgp-ascii-detach-sig
Close the nexus staging repo
1. https://repository.apache.org/index.html
2. Enterprise --> Staging
3. Staging tab --> Name column --> org.apache.bval
4. Right click on the open staging repo (org.apache.bval-XXX) and select Close.
+
+
1. Create a VOTE email thread on bval-dev@ to record votes as replies, like this
2. Create a DISCUSS email thread on bval-dev@ for any vote questions, this
3. Perform a review of the release and cast your vote. See the following for more details on Apache releases
+
Put the release candidate up for a vote
+
http://www.apache.org/dev/release.html + http://incubator.apache.org/guides/releasemanagement.html
+
1. A -1 vote does not necessarily mean that the vote must be redone, however it is usually a good idea to rollback the release if a -1 vote is received. See - Recovering from a vetoed release
2. +
  1. reply to the initial email and prepend to the original subject -
  +
  After the vote has been open for at least 72 hours, has at least three +1 PMC votes and no -1 votes, then post the results to the vote thread by -
  +
  [RESULTS]
  +
  1. Include a list of everyone who voted +1, 0 or -1.
  +
+
+
Put the release candidate up for an Incubator PMC vote
+
1. +
  Create a VOTE email thread on general@incubator to record votes as replies, like this
  +
2. +
  After the vote has been open for at least 72 hours, has at least three +1 Incubator PMC votes and no -1 votes, then post the results to the vote thread by -
  +
  1. replying to the initial email and prepend to the original subject -
  +
  [RESULTS]
  +
  1. Include a list of everyone who voted +1, 0 or -1.
  +
+
+
Finalizing a release
+
+
1. https://repository.apache.org/index.html
2. Enterprise --> Staging
3. Staging tab --> Name column --> org.apache.bval
4. Right click on the closed staging repo (org.apache.bval-XXX) and select Promote.
+
Promote the staged nexus artifacts -
+
1. Copy the distribution artifacts over to the distribution area
+
$ ssh ${user.name}@people.apache.org
+ $ mkdir /www/www.apache.org/dist/incubator/bval/${project.version}
+ $ cd /www/www.apache.org/dist/incubator/bval/${project.version}
+ $ wget https://repository.apache.org/content/repositories/releases/org/apache/bval/bval-parent/${project.version}/bval-parent-${project.version}-source-release.zip
+ $ wget https://repository.apache.org/content/repositories/releases/org/apache/bval/bval-parent/${project.version}/bval-parent-${project.version}-source-release.zip.asc
+ $ wget https://repository.apache.org/content/repositories/releases/org/apache/bval/bval-parent/${project.version}/bval-parent-${project.version}-source-release.zip.md5
+ $ wget https://repository.apache.org/content/repositories/releases/org/apache/bval/bval-parent/${project.version}/bval-parent-${project.version}-source-release.zip.sha1
+
+
Make sure all the copied files have g+rw set and only o+r set
+
$ find . -user ${user.name} -type f | xargs chmod 664 + $ find . -user ${user.name} -type d | xargs chmod 775
+
Note: All of the artifacts are in the maven repos, but we may create an assembly to publish in future releases
+
1. Publish the staged website
+
+
Update the JIRA versions page to mark the version as "released", and set the date to the date that the release was approved. You may also need to make a new release entry for the next release.
+
Announcing the release
After the mirrors have had time to update (24 hours to be on the safe side) update the wiki with pointers to the new release
Make a news announcement on the BeanValidation wiki.
Make an announcement about the release on the bval-users@incubator.apache.org, bval-dev@incubator.apache.org, general@incubator.apache.org, and announce@apache.org list as per the Apache Announcement Mailing Lists page)

Recovering from a vetoed release

+
Reply to the initial vote email and prepend to the original subject -
+
[CANCELED]
+
+
Rollback the version upgrades in trunk by either -
+
1. +
  Restore the 0.1-rc1.tar.gz and run
  +
  $ mvn -Papache-release release:rollback
  +
2. +
  Manually revert the versions in trunk to the prior version and commit
  +
+
+
Delete the svn tag created by the release:perform step -
+
$ svn del https://svn.apache.org/repos/asf/incubator/bval/tags/0.1-incubating -m "deleting tag from rolled back release"
+
+
Drop the nexus staging repo
+
1. https://repository.apache.org/index.html
2. Enterprise --> Staging
3. Staging tab --> Name column --> org.apache.bval
4. Right click on the closed staging repo (org.apache.bval-XXX) and select Drop.
+
+
Remote the staged site
+
+
Make the required updates that caused the vote to be canceled
+
Spin another release candidate!

Verifying release signatures

On unix platforms the following command can be executed -

  for file in `find . -type f -iname '*.asc'`
+  do
+      gpg --verify ${file} 
+  done
+

+ + +

You'll need to look at the output to ensure it contains only good signatures -

gpg: Good signature from ... +gpg: Signature made ...

+ + + + + Added: websites/staging/rave/trunk/content/rave/release-setup.html ============================================================================== --- websites/staging/rave/trunk/content/rave/release-setup.html (added) +++ websites/staging/rave/trunk/content/rave/release-setup.html Tue Jun 14 21:29:04 2011 @@ -0,0 +1,181 @@ + + + + + + + + + + + + + + + +

Title:Release Guide +Notice: Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + . + http://www.apache.org/licenses/LICENSE-2.0 + . + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. +These setup steps only need to be performed on a particular machine once.

Developers using Linux workstations can skip over the references to Cygwin. If using Windows, install cygwin, including Utils/gnupg and Net/openssh packages.

Create and install a SSH key

Open a shell window. If using Windows, open a cygwin window.
Use ssh-keygen to create an SSH key.

Follow the latest steps and guides on the ASF website as you should NOT be using SHA1 and new keys MUST be at least 4096 bits.

`$ ssh-keygen -t rsa -b 4096`
+

+ + +

Program defaults should be fine. No passphrase is required for the ssh key generation. The keys will be saved in ~/.ssh/id_dsa (private) and ~/.ssh/id_dsa.pub (public).

See Authenticating By Public Key (OpenSSH) for a good description on why and how to perform this task.

SCP your SSH public key ~/.ssh/id_dsa.pub created in last step to ~/id_dsa.pub on people.apache.org.
+

$ cd ~/.ssh + $ scp id_dsa.pub <your userid>@people.apache.org:id_dsa.pub + $ You will be prompted for your password. +4. Use ssh to login to people.apache.org

`$ cd ~    
+$ ssh <your userid>@people.apache.org  
+`
+

+ + +

At this point, you will still be prompted for your password.

+
Create a ~/.ssh folder in your home directory on people.apache.org and change its file mode to 700.
+
$ mkdir ~/.ssh +$ chmod 700 ~/.ssh
+
+
Move or append ~/id_dsa.pub to ~/.ssh/authorized_keys and change its file mode to 600.
+
$ mv ~/id_dsa.pub ~/.ssh/authorized_keys +$ chmod 600 ~/.ssh/authorized_keys
+
+
- *Each public key in the authorized_keys spans only one line.
- For example: "ssh-dss AAAAB3NzaC1kc3MAAA ..... agBmmfZ9uAbSqA== dsa-key-20071107"
- '#' in the first column is a comment line.*
+
+
Exit out of this ssh session.
+
+
Start a new ssh session. No login should be required this time due to the private ssh key on your local box matching up with the public ssh key in your home directory (~/.ssh).
+
$ ssh <your userid>@people.apache.org
+
If you are still prompted for a password, then you have not set up the ssh keys properly. Review the steps above and ensure that all of the steps were followed properly. Or, maybe the instructions are still not quite right and they still need some adjusting. In that case, please update the instructions accordingly.
+

Create a GPG key

Open a shell window. If using Windows, open a cygwin window.
+
Generate a key-pair with gpg, using default key kind ("RSA and RSA") and keys size (4096).
+
$ gpg --gen-key
+
The program's default values should be fine. For the "Real Name" enter your full name (ie. Stan Programmer). For the "e-mail address" enter your apache address (ie. sprogrammer@apache.org). You will also be required to enter a "passphrase" for the GPG key generation. Keep track of this as you will need this for the Release processing.
+
+
The generated keys are stored in $HOME/.gnupg or %HOME%Application Datagnupg subdirectory.
+
+
Save the content in this subdirectory to a safe media. This contains your private key used to sign all the Rave release materials.
+
+
Backup your home directory to another media ||
+
+
Add your public key to the SVN repository. See the commands describe at the beginning of this KEYS file to perform this task. The gpg key-pair is used to sign the published artifacts for the Rave releases.
+
$ gpg --list-sigs <Real Name> && gpg --armor -- export <Real Name>
+
The KEYS file is updated via normal svn commit procedures. The one under w.a.o/dist/ has to be manually updated from svn.
+
+
Submit your public key to a key server. E.g. SURFNET or MIT
+
+
Following the instructions in http://people.apache.org/~henkp/trust/ and ask multiple (at least 3) current Apache committers to sign your public key.
+

+ + + + +

General

Community

Development

ASF

Release Management

Apache Rave Release Guidelines

General

Community

Development

ASF

Incubator Release Steps

Recovering from a vetoed release

Verifying release signatures

General

Community

Development

ASF

Create and install a SSH key

Create a GPG key