Return-Path: 
 <repository-return-2824-apmail-repository-archive=apache.org@apache.org>
Delivered-To: apmail-repository-archive@www.apache.org
Received: (qmail 21820 invoked from network); 14 Apr 2009 13:47:48 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3)
  by minotaur.apache.org with SMTP; 14 Apr 2009 13:47:48 -0000
Received: (qmail 84870 invoked by uid 500); 14 Apr 2009 13:47:47 -0000
Delivered-To: apmail-repository-archive@apache.org
Received: (qmail 84748 invoked by uid 500); 14 Apr 2009 13:47:47 -0000
Mailing-List: contact repository-help@apache.org; run by ezmlm
Precedence: bulk
list-help: <mailto:repository-help@apache.org>
list-unsubscribe: <mailto:repository-unsubscribe@apache.org>
List-Post: <mailto:repository@apache.org>
Reply-To: repository@apache.org
List-Id: <repository.apache.org>
Delivered-To: mailing list repository@apache.org
Received: (qmail 84728 invoked by uid 99); 14 Apr 2009 13:47:47 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 14 Apr 2009 13:47:47 +0000
X-ASF-Spam-Status: No, hits=1.2 required=10.0
	tests=SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (athena.apache.org: 209.85.217.161 is neither permitted
 nor denied by domain of brianf@infinity.nu)
Received: from [209.85.217.161] (HELO mail-gx0-f161.google.com)
 (209.85.217.161)
    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 14 Apr 2009 13:47:37 +0000
Received: by gxk5 with SMTP id 5so5247286gxk.17
        for <multiple recipients>; Tue, 14 Apr 2009 06:47:15 -0700 (PDT)
Received: by 10.90.68.12 with SMTP id q12mr6004674aga.7.1239716833311;
        Tue, 14 Apr 2009 06:47:13 -0700 (PDT)
Received: from ?192.168.101.17? (c-98-229-140-52.hsd1.nh.comcast.net
 [98.229.140.52])
        by mx.google.com with ESMTPS id 9sm8081726agc.62.2009.04.14.06.47.11
        (version=SSLv3 cipher=RC4-MD5);
        Tue, 14 Apr 2009 06:47:12 -0700 (PDT)
Message-ID: <49E493DF.3010308@infinity.nu>
Date: Tue, 14 Apr 2009 09:47:11 -0400
From: Brian Fox <brianf@infinity.nu>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: repository@apache.org
CC: vkumar@apache.org, Portals Discussion <general@portals.apache.org>
Subject: Re: [repository.apache.org] releases
References: <200904140000.n3E00pZ1023662@repository.apache.org>
 	<adba96190904131709g593ff66asf7d0a09815c2e6e3@mail.gmail.com>
 	<eb0f802d0904131744r24988ba9ocf7e46812d58cba9@mail.gmail.com>
 <eb0f802d0904131746r6935e937j494972ebf18fd637@mail.gmail.com>
 <49E43125.2090101@douma.nu> <49E47776.5060207@infinity.nu>
 <49E47C45.40200@douma.nu>
In-Reply-To: <49E47C45.40200@douma.nu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

Ate Douma wrote:
> Brian Fox wrote:
>> Hi Ate, Vkumar,
>>
>> The switch from the old static repository to Nexus shouldn't have 
>> affected any part of the release:prepare or release:perform process 
>> performed by Maven other than the actual url used in the 
>> distributionManagement. The only steps that change are _after_ the 
>> artifacts are made and signed and deployed, where you would close and 
>> then later promote the repository.
>>
>> So the question is, did the portals project produce the signatures 
>> for previous releases, and if so, how?
> No.
Ok that explains it ;-)
>
> The releases of these portals/portals-pom and portals/applications-pom 
> projects using Nexus were the first (1.0).
> Therefore, we assumed (maybe incorrectly) that by following all the 
> guidelines of setting up these poms and the releasing steps as 
> indicated, the signing of the artifacts would now also be done more or 
> less "automatically".
> AFAIK, we literally followed all instructions, and after again 
> reviewing our poms I can't find anything different or wrong from the 
> examples given.
>
>>
>> The maven release document isn't intended to be a master document on 
>> how to setup a project from scratch to generate everything 
>> correctly...but perhaps that is what is needed for new projects. I'll 
>> have to look at your poms to figure out what might be wrong.
> If you coould do that, much appreciated.
> Another pair of eyes might detect something obvious we simply overlooked.
I have a suspicion just thinking it through based on some weirdness I 
saw recently in the Maven pom that isn't documented. I'll have to test 
to confirm though.
>
>>
>> Signing the artifacts after the fact is definately more complicated 
>> since the system isn't setup for direct manipulation of the artifacts 
>> by committers. It should be possible via a script to gen and upload 
>> the signatures though, so I'll work that out.
> OK, great. Please keep us posted.
>
> Regards,
>
> Ate
>
>>
>> Ate Douma wrote:
>>> Hi Brian, Wendy,
>>>
>>> Just looked at the released poms and there are no gpg signatures 
>>> indeed.
>>> What I'm surprised about is how those are not "automatically" 
>>> generated when following the Nexus release instructions as described 
>>> here:
>>>
>>>   http://maven.apache.org/developers/release/releasing.html
>>>
>>> Vivek has been following those instructions to the letter (we've 
>>> actually went to those together as this is the first time Portals 
>>> used Nexus for a release) and AFAIK our poms have all the required 
>>> plugin configurations needed as described, including the "release" 
>>> profile and the maven-gpg-plugin configuration.
>>>
>>> So, 3 questions:
>>>
>>> - is something missing from the release instructions (see above)
>>> - or did we forget/overlook an essential step (please indicate which 
>>> and where)
>>> - what is the practical quick solution to provide the gpg signatures 
>>> "after the fact" (using Nexus)
>>>
>>> Regards,
>>>
>>> Ate
>>>
>>> Brian Fox wrote:
>>>> I know I need to make emails, it's actually in 1.3.2 I just need to 
>>>> find a good time to upgrade. You can see the staging and promotion 
>>>> events here: 
>>>> https://repository.apache.org/service/local/feeds/systemChanges
>>>>
>>>> On Mon, Apr 13, 2009 at 8:44 PM, Brian Fox <brianf@infinity.nu 
>>>> <mailto:brianf@infinity.nu>> wrote:
>>>>
>>>>     It was vkumar....
>>>>
>>>>
>>>>     On Mon, Apr 13, 2009 at 8:09 PM, Wendy Smoak <wsmoak@gmail.com
>>>>     <mailto:wsmoak@gmail.com>> wrote:
>>>>
>>>>         The portals poms are missing signatures, but I can't tell who
>>>>         released
>>>>         them.  -Wendy
>>>>
>>>>         On Mon, Apr 13, 2009 at 5:00 PM,  <brianf@apache.org
>>>>         <mailto:brianf@apache.org>> wrote:
>>>>          > Repository changed
>>>>          > ==================
>>>>          >
>>>>          > Repository:
>>>>         
>>>> /export/home/nexus/nexus-professional/sonatype-work/nexus/storage/releases 
>>>>
>>>>          >
>>>>          > Added
>>>>          > -----
>>>>          > [nexus] /org/apache/portals
>>>>          > [nexus] /org/apache/portals/portals-pom
>>>>          > [nexus] /org/apache/portals/portals-pom/1.0
>>>>          > [nexus] 
>>>> /org/apache/portals/portals-pom/1.0/portals-pom-1.0.pom
>>>>          > [nexus]
>>>>         /org/apache/portals/portals-pom/1.0/portals-pom-1.0.pom.sha1
>>>>          > [nexus]
>>>>         /org/apache/portals/portals-pom/1.0/portals-pom-1.0.pom.md5
>>>>          > [nexus] /org/apache/portals/portals-pom/maven-metadata.xml
>>>>          > [nexus] 
>>>> /org/apache/portals/portals-pom/maven-metadata.xml.md5
>>>>          > [nexus] 
>>>> /org/apache/portals/portals-pom/maven-metadata.xml.sha1
>>>>          > [nexus] /org/apache/portals/applications-pom
>>>>          > [nexus] /org/apache/portals/applications-pom/1.0
>>>>          > [nexus]
>>>>         
>>>> /org/apache/portals/applications-pom/1.0/applications-pom-1.0.pom.md5
>>>>          > [nexus]
>>>>         
>>>> /org/apache/portals/applications-pom/1.0/applications-pom-1.0.pom.sha1
>>>>          > [nexus]
>>>>         
>>>> /org/apache/portals/applications-pom/1.0/applications-pom-1.0.pom
>>>>          > [nexus]
>>>>         /org/apache/portals/applications-pom/maven-metadata.xml.sha1
>>>>          > [nexus] 
>>>> /org/apache/portals/applications-pom/maven-metadata.xml
>>>>          > [nexus]
>>>>         /org/apache/portals/applications-pom/maven-metadata.xml.md5
>>>>         ...
>>>>
>>>>
>>>>
>>>
>>
>>
>